Scams and Unauthorised Bank Transfers: Bank and Customer Responsibility

The Bank-Customer Relationship

The relationship between a bank and its customer is primarily contractual. When a company opens a business account, it enters into an agreement governed by the bank's terms and conditions, which form the basis of the parties' rights and obligations. These terms typically address matters such as the authority to operate the account, the bank's mandate to act on instructions, and the allocation of risk for unauthorised transactions.

A bank may generally pay out only on the customer's genuine instructions. Where a payment goes out on an instruction the customer did not give, the question is whether the bank acted within its mandate. Where the customer itself was tricked into authorising the payment, the instruction is genuine, and the question becomes whether the bank should have spotted warning signs.

The Bank's Duty of Care

Banks owe their customers a duty to exercise reasonable care and skill in carrying out instructions and safeguarding accounts. This duty arises both from the express terms of the banking contract and from implied terms. A bank that pays out funds on a forged or unauthorised instruction may, depending on the circumstances, be liable for breach of its mandate.

However, the bank's liability is not absolute. Courts will examine whether the bank followed its own procedures, whether it had reason to suspect fraud, and whether the customer contributed to the loss through its own conduct.

The Customer's Obligations

Business customers also have obligations. These typically include safeguarding login credentials, security devices, and authorisation codes. Most banking terms require customers to notify the bank promptly upon discovering any unauthorised activity. A customer who delays reporting or who has been negligent in protecting their account security may find that the bank's terms limit or exclude the bank's liability.

Bank Negara Malaysia's Regulatory Framework

Bank Negara Malaysia, as the central bank and regulator of financial institutions, has issued policy documents addressing electronic fraud and the responsibilities of financial service providers. These are issued under the Financial Services Act 2013 and include requirements on technology risk, customer authentication and fraud detection.

In September 2022, Bank Negara Malaysia directed banks to take further anti-scam measures: moving from SMS one-time passwords to more secure authentication, tighter fraud detection and blocking of suspicious transactions, a cooling-off period when online banking or a secure device is first enrolled, limiting authentication to one mobile or secure device per account holder, and 24-hour scam hotlines. Banks must also give customers a quick way to suspend their accounts (often called a kill switch) if they suspect a compromise. Financial institutions are expected to have mechanisms in place to detect and respond to suspicious transactions.

These requirements bind the banks as regulatory rules. Whether a customer can sue on them directly is a separate question, but they may be relevant when assessing whether a bank has met its obligations.

The National Scam Response Centre

The National Scam Response Centre, known as the NSRC, was established as a coordination mechanism involving Bank Negara Malaysia, the Royal Malaysia Police, the Malaysian Communications and Multimedia Commission, and financial institutions. Its purpose is to enable rapid response to scam reports and to facilitate the tracing and freezing of funds that have been fraudulently transferred.

The NSRC operates the 997 hotline that victims can call to report scams. When a report is made, the centre works with the relevant banks to attempt to halt or recover the transferred funds. Speed is critical: the sooner a scam is reported, the greater the chance that funds can be frozen before they are withdrawn or transferred further.

Businesses that have been scammed should contact the NSRC immediately, in addition to lodging a police report. The NSRC does not replace the need for a police report, which remains essential for any subsequent investigation or legal proceedings.

The Financial Markets Ombudsman Service

The Financial Markets Ombudsman Service (FMOS) took over the work of the former Ombudsman for Financial Services on 1 January 2025. It is an independent body, approved by Bank Negara Malaysia and the Securities Commission, that resolves disputes between financial consumers and financial service providers, including banks. It handles disputes over unauthorised transactions through internet banking, cards, ATMs and e-money where the direct loss does not exceed 250,000 ringgit.

Not every business can use it. Eligible complainants include individuals and, for business accounts, micro and small enterprises as defined by SME Corporation Malaysia. FMOS decides eligibility. Its decisions bind the bank if the complainant accepts them; a complainant who does not accept may still go to court.

Before approaching FMOS, a complainant must first complain to the bank and receive its final decision. The dispute should then be referred to FMOS within six months of that decision.

Court Proceedings

Where the business is not eligible for FMOS, the loss exceeds its limit, or the matter is otherwise unsuitable for it, a business may need to pursue its claim through the courts. Civil claims against banks for unauthorised transactions are typically founded on breach of contract, though claims in negligence or for breach of statutory duty may also arise depending on the facts.

In Peninsular Malaysia, the Limitation Act 1953 sets time limits for starting court proceedings. For contract claims, section 6 generally allows six years from the date the cause of action accrued. Sabah and Sarawak have their own limitation laws. Businesses should seek legal advice promptly to ensure they do not lose the right to bring a claim through delay.

Practical Steps for a Scammed Business

A company that has fallen victim to a scam or unauthorised transfer should take the following steps:

• Contact the bank immediately to report the incident and request that the receiving account be frozen if possible.
• Call the National Scam Response Centre on 997 without delay.
• Lodge a police report, providing all relevant details and documentation.
• Preserve all evidence, including emails, messages, transaction records, and any communications with the fraudster.
• Review how the fraud occurred and take steps to secure accounts and systems against further compromise.
• Consider whether the bank has met its obligations and whether a complaint to the bank, and then to FMOS, is warranted.
• Seek legal advice on the available options for recovery.

Internal Review

Directors should also consider whether the company's internal controls were adequate. Under section 213 of the Companies Act 2016, directors must act for a proper purpose and in good faith in the company's interest, and must exercise reasonable care, skill and diligence. A significant fraud may prompt questions about whether existing procedures for authorising payments and verifying requests were sufficient.

Allocation of Loss

The question of who bears the loss in a scam or unauthorised transfer case is highly fact-sensitive. Relevant considerations include whether the bank followed proper verification procedures, whether the customer complied with security requirements, whether there was contributory negligence, and the terms of the banking contract.

There is no automatic rule that the bank must make good every fraudulent transaction, nor that the customer must always bear the loss. Each case turns on its own facts, and businesses in this situation should obtain legal advice tailored to their circumstances.

Common questions

If my company is scammed, is the bank automatically liable?

Not automatically. Liability depends on the banking contract terms, whether the bank followed proper procedures, and whether your company met its own security obligations. Each case is assessed on its facts.

How quickly must I report a scam to the bank?

Immediately. Most banking terms require prompt notification, and the faster you report, the better the chance that funds can be held before they move on. Call your bank's fraud hotline and the National Scam Response Centre on 997.

What is the National Scam Response Centre?

The NSRC is a coordination centre involving the police, Bank Negara Malaysia, the communications regulator and banks. It helps trace and hold scam proceeds. Call 997 immediately after discovering a scam, and also lodge a police report.

Can my business complain to the Financial Markets Ombudsman Service?

Possibly. FMOS hears disputes up to 250,000 ringgit from individuals and micro and small enterprises. You must first complain to the bank and get its final decision, then refer the dispute to FMOS within six months.

How long do I have to take legal action against the bank?

In Peninsular Malaysia, the Limitation Act 1953 generally allows six years from when the cause of action arose for contract claims. Sabah and Sarawak have their own rules. Seek legal advice promptly to protect your position.