Fake BNM Mobile Security App Relays Malaysians' Bank Cards Over NFC, MyCERT Warns

Scammers posing as Bank Negara Malaysia are getting victims to install an Android app called "BNM Mobile Security" that turns their phone into a card reader for the criminals. MyCERT, the response team at CyberSecurity Malaysia, describes it in advisory MA-1495.112026 of 4 November as an NFC card-relay banking trojan. Each card the victim taps against the phone is passed live to the scammer's own device, "enabling unauthorised contactless payments and ATM cash withdrawals".

MyCERT gives no count of victims or losses.

How the scam runs

According to MyCERT, the fraudsters impersonate BNM, the police or "anti-money-laundering officers" and tell the victim their bank account is linked to money laundering. The app comes from a fake page dressed up as the BNM AML/CFT portal, on the domain bnmgov[.]my[.]id.

Once installed, the app collects a name, IC or passport number, phone number and email. Next comes a fake "verification" screen asking for each card's balance, credit limit and 6-digit payment PIN, after which the victim is told to tap the cards against the phone. The Star, reporting the advisory, adds that the card data goes "to the scammer's server through an encrypted connection". MyCERT says the app "reads contactless cards of all major schemes (MyDebit, Visa, Mastercard, American Express, JCB)", and that a packer called dpt-shell hides its real code.

Indicators for banks

The advisory lists the Android package com.client.bnm and the command server ws.mobilesecurity[.]eu[.]cc at 172.86.82.166, with file hashes. Banks are asked to block those domains and addresses at their gateways and monitor for "contactless POS / ATM velocity spikes and new-device NFC transactions" shortly after a customer reports a "BNM" or "police" call.

What MyCERT tells the public

The advisory tells people not to install "BNM Mobile Security" or any app sent after a phone call, and to "never tap your bank card on a phone when instructed by a caller or an app". It adds that "BNM and banks never ask for a card PIN". MyCERT's steps for anyone who installed it: block all cards immediately, change the PINs, uninstall com.client.bnm and run a mobile security scan. MyCERT asks victims to report it to the National Scam Response Centre on 997 and to Cyber999, whose 24x7 incident line is +60 19 2665850.