The Malaysia Computer Emergency Response Team (MyCert) has issued an advisory on a fake Android ‘BNM Mobile Security’ or trojan banking app hosted on a website impersonating Bank Negara Malaysia (BNM).
“The scam is driven by phone calls in which fraudsters impersonate BNM, the police or ‘anti-money laundering officers’ and pressure victims into installing the app and tapping their bank cards.
“Bank Negara Malaysia does not run this campaign, and its official channels (bnm.gov.my) do not host or distribute a ‘BNM Mobile Security’ application,” said MyCert, which operates under Cybersecurity Malaysia, in an advisory posted on its website on Nov 4.
It explained that the scam begins with a phone call claiming that the victim’s bank account is linked to money laundering.
The victim is then directed to a fake BNM website to download a malicious app, which collects information such as personal details, card balances, credit limits and PINs.
The app then tricks victims into tapping their bank cards against their phones, allowing scammers to secretly capture and relay card information to another device to carry out unauthorised contactless transactions or ATM withdrawals.
MyCert explained that the app conceals its actual functions behind a seemingly legitimate interface.
It uses the phone’s Near Field Communication (NFC) capability to communicate with contactless bank cards, read their payment information and relay the data to the scammer’s server through an encrypted connection.
This allows criminals to use the relayed card information to carry out unauthorised transactions.
MyCert added that the app does not target any specific bank but instead exploits the contactless payment function of physical bank cards.
“It reads contactless cards of all major schemes (MyDebit, Visa, Mastercard, American Express, JCB).
“Any Malaysian bank card the victim taps is at risk, including cards issued by Maybank, CIMB, Public Bank, RHB, Hong Leong Bank, AmBank, Bank Islam, BSN, Affin Bank, Alliance Bank, Bank Rakyat and other local issuers.”
MyCert urged members of the public not to install BNM Mobile Security or any application at the request of someone who contacts them by phone.
“Bank Negara Malaysia’s official channels do not host or distribute a ‘BNM Mobile Security’ application, and BNM and banks never ask for a card PIN.”
Members of the public are also advised never to tap their bank cards against a phone when instructed to do so by a caller or an application.
