Your Bank Has A Kill Switch. You’ve Never Touched It.
Nine settings already sitting in your banking app will stop most of this year's scams. Ten minutes on the sofa before the Deepavali-to-11.11 week, and one rule for the hour after, if it goes wrong anyway.
Table of Contents
Bank scam protection in Malaysia takes ten minutes. The Nine-Switch Check covers nine banking app settings:
1) app approval instead of SMS TAC,
2) one registered device,
3) a low daily transfer limit,
4) card online and overseas toggles,
5) alerts on every transaction,
6) the card freeze,
7) the kill switch,
8) the cooling-off period,
9) a small shopping account. Scammed anyway? Call the NSRC on 997 within the first hour.
It’s 11:58 PM on 10 November. Deepavali was Sunday, the murukku tin is already half empty, and the cart you built during the long weekend is sitting there with the midnight voucher counting down. Phone on 9 per cent. Then a message slides in: a parcel from last week is held at the depot, RM3.50 redelivery fee, pay here.
You know the drill. You’d never fall for that. Except it’s midnight, you’ve paid RM3.50 fees before, and the voucher has ninety seconds left.
Here’s the thing nobody at a bank will say out loud. Scammers don’t beat your bank’s security. They haven’t the skill. What they beat is the gap between the security your bank built and the security you’ve actually switched on. They need one of two things: your thumb on an approval, or twenty quiet minutes before anyone notices.
Twenty minutes is generous. The Home Minister told reporters in March 2026 that in some cases 80 to 90 per cent of an account was gone within three to ten minutes, bounced through mule accounts. Malaysians lost RM2.97 billion to online scams in 2025, close to double the year before, and another RM830 million by the end of May 2026.
You are not too clever for this. You are too busy. That is the whole business model, and the week between Deepavali (Sunday 8 November) and 11.11 (the Wednesday after) is its busiest week of the year.
So: ten minutes, nine switches, before the sale. Most of them your bank put there in 2023 on Bank Negara’s instruction and then never told you about.
The Nine-Switch Check: Bank Scam Protection In Ten Minutes
Everything below lives under Settings, Security or Manage Cards in your banking app. The names differ from bank to bank; the switches don’t.
Switch 1: Turn SMS TAC Off And In-App Approval On
The six-digit code that used to arrive by SMS now arrives inside the app, as a push you approve with your thumb. Maybank calls it Secure2u; every bank has its own name for the same thing. The point isn’t the name. A code typed into a website can be typed into a fake website. A push that only shows the real amount and the real payee, on your own phone, cannot.
If your app still offers SMS as an option, turn it off. If you’ve been ignoring the “activate in-app approval” nag for two years, this is the nag winning.
Switch 2: Keep One Registered Phone, And Check Which One
Your bank now lets one device hold the approval key. Open the device list and look. If your old phone from 2023 is still there, remove it. If there’s a device you don’t recognise, stop reading and go to the section on the first sixty minutes.
This one switch is why “please re-register your device to keep your account active” is the most common lie of the season. Nobody at a bank sends that.
Switch 3: Set A Daily Transfer Limit You Would Be Mildly Annoyed By
Set it to what one ordinary day needs, not what one extraordinary day might. If your normal week is Grab, groceries and a RM300 transfer to Mum, a RM1,000 daily limit costs you nothing and caps what any scam can take in a day at RM1,000.
The big-ticket purchase, the deposit, the aircond: plan it. Raise the limit the night before, because raising it now comes with a wait (see Switch 8). That wait is the feature.
Switch 4: Card Online And Overseas Toggles Off
Most card apps now have a toggle for online (card-not-present) transactions, one for overseas, and a limit for each. For the sale: online on, overseas off, limit at the size of your cart. After the sale: online off again. Twenty seconds each way.
If your card’s app has none of these toggles, that’s worth knowing before you put it in the Shopee wallet. If you are shopping for a new card anyway, you can compare fees, cashback, and minimum income on iMoney, then confirm these toggles in the issuer’s app before you apply: compare credit cards.
Switch 5: Alerts On Every Transaction, Threshold At The Bottom
Most people set transaction alerts at RM500 and above. Scammers know this, which is why the test transaction is RM1. Set the threshold to the lowest the app allows, push and SMS both. The RM1 ping at 2am is annoying exactly once, and that once is the one that matters.
Switch 6: Find The Card Freeze
Every card app has a freeze or lock toggle. Find it now, so at 2am you aren’t searching for it. Freeze stops new transactions and leaves your standing instructions alone. It’s reversible in one tap, while the next switch takes a branch visit or a verified call to undo, and that’s why you reach for this one first.
Switch 7: Find The Kill Switch, And Do Not Press It Yet
This is the one you’ve never touched. The kill switch cuts your online banking dead: every session logged out, every transfer and payment blocked. Banks were required to put it in the app in 2023; the Association of Banks in Malaysia says around 300,000 customers activated it in 2025.
Find it. Note the three taps to reach it. Then leave it alone, because switching it back on usually means a branch visit or a verified call to customer care. It is the fire extinguisher, not the light switch. You want to know where it is; you do not want to need it.
Switch 8: Respect The Cooling-Off Period
Register online banking for the first time, move to a new phone, or raise a transfer limit, and your bank makes you wait, typically twelve hours, before the change bites. Nothing to switch on here. The job is to stop a scammer talking you out of it.
The twelve hours exist so that you get a notification, look at it, and say “that wasn’t me” while the scammer is still waiting. Anyone urging you to “complete verification now to skip the waiting period” is the person the waiting period was built to catch.
Switch 9: Point Shopping Apps At A Small Account
Not a security setting in the strict sense, but it does more than most of them. Open a second account or use an e-wallet, float it with the month’s shopping money, and link that, not your salary account, to Shopee, Lazada and TikTok Shop. If something leaks, it leaks from a RM600 pond, not a RM20,000 lake.
A cashback card with a low online limit does the same job for card spend, and pays you for the sale while it’s at it: cashback credit cards.
The First Hour: What To Do After You Are Scammed In Malaysia
Say it happened anyway. You approved something you shouldn’t have, or the RM1 ping was followed by a RM4,990 ping. The next hour decides how much comes back. The Home Minister’s words: the first one to two hours are crucial. Here is the First Hour, by the clock.
Minute 0 To 5: Call 997, The National Scam Response Centre
Before the bank, before the police station, before your spouse. 997 is the National Scam Response Centre, run by the police with Bank Negara, and since September 2025 it answers around the clock. Have ready: your account number, the time and amount of each transfer, the receiving account and bank if you can see it, and the number or link that started it. Ask for your report reference and write it down.
Since March 2026, the government has said a 997 call is treated as a police report, so you no longer need to queue at a station that night. Keep the reference in case your bank or insurer later asks for paper.
Why first: 997 can reach the receiving bank and freeze the mule account while the money is still in it. Between January and July 2026, the centre seized RM7.94 million and returned RM5.16 million of it. Every hour you wait, the scammer makes another transfer out, and the freezable amount shrinks.
Minute 5 To 15: Freeze The Card, Then Kill Online Access
Now your own bank. Freeze the card in the app (Switch 6). If your login or device may be compromised, hit the kill switch (Switch 7). Then call the bank’s 24-hour line, which you saved in your phone this week under a name you’ll find at 2am, and tell them the 997 reference. Every bank’s 24-hour fraud line is listed at JanganKenaScam.com, the banking industry’s scam directory.
The order matters. Freeze is reversible, so do it first and without thinking. Kill is far harder to undo, so do it when the scam involved your login rather than just your card.
Minute 15 To 30: Keep The Evidence, Secure Your Email
Don’t delete the chat, the call log or the fake website. Screenshot everything, including the sender’s number. Change the password on your email, because the email is how the next scam gets in. You can also check the receiving account number or phone number on the police Semak Mule portal.
Minute 30 To 60: Ignore The Second Scammer
Somewhere in this hour, a kind-sounding officer may call to “help recover your funds”. Banks never ask for your password, PIN or TAC, and nobody helping you recover money should either. Hang up, and call 997 back on the number you dialled yourself.
Then, and only then, make the kopi.
Why The Nine-Switch Check Works Against Scams
A scam is a race between the scammer and your attention. Every switch above does one of three things to that race.
Switches 1, 2 and 8 take away the scammer’s shortcut: no SMS code to phish, no second phone to register, no instant limit increase. They have to come through your thumb, on your phone, after a wait.
Switches 3, 4 and 9 shrink the prize. The most a bad night can cost is a day’s limit from a small account, not a salary account’s balance. Nobody builds a syndicate around RM600 ponds.
Switches 5, 6 and 7, and the First Hour, buy back the twenty minutes. The RM1 ping, the freeze you can find blind, the kill switch, and 997 before the money leaves the mule account. Between January and July 2026 the NSRC returned 65 per cent of the money it seized, and officials keep repeating one instruction to victims: call early.
None of it makes you scam-proof. It makes you slower to rob and faster to stop, which, in a race, is the same thing.
Where To Start Tonight: Switches 5, 6 And 7
Tonight, on the sofa, open the banking app and go to Settings. Do Switches 5, 6 and 7 only: alerts to the minimum, find the freeze, find the kill switch. That’s under ten minutes and it’s the three that matter at 2 AM. Save the bank’s 24-hour line and 997 in your contacts as “BANK SCAM LINE” and “997 SCAM”. The other six can wait for the weekend.
If a scam has already taken money you’d set aside, and the bills are now out of sequence, the first consultation with an iMoney adviser is free: iMoney Financial Advisory. If the gap went on a card, the debt consolidation calculator shows what clearing it costs monthly, no sign-up.
Your bank built a kill switch for you three years ago. The least you can do is know where it is.
The Nine-Switch Check at a glance
| Switch | Where | What it stops | Time |
|---|---|---|---|
| 1. App approval on, SMS TAC off | Settings, Security | Phished codes | 1 min |
| 2. One device, check the list | Settings, Devices | Scammer’s phone holding your key | 1 min |
| 3. Daily limit at one normal day | Settings, Limits | Big single-day loss | 1 min |
| 4. Card online/overseas toggles | Manage Cards | Card-not-present fraud | 1 min |
| 5. Alerts on everything, lowest threshold | Settings, Notifications | The RM1 test going unseen | 1 min |
| 6. Find the card freeze | Manage Cards | Searching at 2 AM | 1 min |
| 7. Find the kill switch | Settings, Security | Searching at 2 AM | 1 min |
| 8. Respect the cooling-off | Nothing to set | Being rushed past the wait | 0 min |
| 9. Small shopping account | New account or e-wallet | Salary account exposure | 3 min (e-wallet) |
If it goes wrong: 997 first, inside the hour; freeze, then kill; keep the evidence; ignore the second caller.
Bank Scam Protection In Malaysia: FAQs
The kill switch is a self-service feature, required of banks since 2023, that instantly cuts off your online banking: sessions are logged out and transfers and payments are blocked. The name varies, for example Safe Switch at BSN and Emergency Lock at Hong Leong Bank, and some banks also use it to block cards. Reactivating usually needs a branch visit or a verified call, so find it now and use it only if your login may be compromised.
Call 997 first, inside the hour, with your account number and transfer details. Then freeze your card, use the kill switch if your login is compromised, call your bank’s 24-hour line, and keep all evidence. This is the First Hour sequence.
The government has said since March 2026 that a call to the National Scam Response Centre on 997 is treated as a police report, so you do not have to queue at a station that night. Keep your report reference, because your bank or insurer may still ask for a written copy, and ask the 997 officer whether your case needs a separate report.
The cooling-off period is a waiting time your bank applies after first-time registration, a new device or a transfer-limit increase. Many banks apply about 12 hours to limit increases, for example Maybank and HSBC. The wait gives you time to spot a request you did not make, so do not let anyone rush you past it.
Set it to what one ordinary day needs, for example RM1,000 if your week is groceries, transport and small transfers, and raise it the night before a big purchase. Raising a limit triggers the cooling-off period, so plan ahead. A low limit caps what a scam can take in a day.
The National Scam Response Centre (NSRC) is the police-led hotline for reporting online scams. Dial 997; it has operated 24 hours a day since September 2025. Officers can alert banks to freeze the account that received your money, which works best when you call as early as possible, ideally within the first hour or two.
After you call 997, freeze the card first: it blocks new card transactions and is easy to undo. Use the kill switch if your login or device may be compromised, because it cuts all online banking access and is much harder to reverse.
Open your banking app, go to Settings or Security and look for the in-app approval option, such as Secure2u at Maybank, then follow the prompts to register your phone. Menus and names vary by bank. If your bank still offers SMS as a choice, switch it off, because a code typed into a fake website can be stolen while an in-app approval shows the real amount and payee.
Not automatically. Bank Negara has said banks bear fraud losses caused by lapses in their own security, but each case is assessed individually. Report to 997 and your bank straight away, because fast reporting gives the best chance of freezing the money before it moves on.
Banks never ask for your online banking password, PIN or TAC, and nobody helping you recover money should either. If a caller offers to recover your funds for a fee, hang up. Then call 997 or your bank’s official 24-hour line yourself, on a number you dialled, not one the caller gave you.
Only part of what is stolen. Between January and July 2026 the NSRC returned RM5.16 million, or 65 per cent, of the RM7.94 million it seized, according to the Home Minister. That is a share of frozen funds, not of everything lost: online scam losses reached RM2.97 billion in 2025.
Nine: in-app approval instead of SMS TAC, one registered device, a low daily transfer limit, card online and overseas toggles, alerts on every transaction, the card freeze, the kill switch, the cooling-off period and a small account for shopping apps. The Nine-Switch Check takes about ten minutes; start with alerts, the freeze and the kill switch.
