Updated: September 2026
A credit card transaction on your bill that you do not recognise doesn’t automatically mean you have to pay for it. There may be a simple explanation, such as a transaction you have forgotten about or a temporary hold, but in the worst-case scenario, it could also be someone using your card or card details without your permission. So what do you do then?
The first step is to check the transaction before reporting it to your bank. If you still cannot identify the charge, your bank can investigate what happened and determine who should bear the loss. While the investigation is ongoing, you do not have to pay the disputed amount. If the bank decides you are responsible, you can ask why and challenge the decision.
At RinggitPlus, we know it doesn’t pay to panic; follow our simple steps to find out what went wrong and how to fix it.
Check Whether The Transaction Is Really Fraud
An unfamiliar charge is not necessarily fraudulent, particularly when the merchant name on your statement differs from the business you remember using.
Online marketplaces, payment processors, and subscription services can appear under names you do not immediately recognise. Check your email receipts, shopping accounts, and recurring payments to see whether the merchant name matches the one on your credit card bill before treating the charge as fraud.
You should also check whether the transaction is still pending. A pending transaction may be a temporary pre-authorisation hold, where a merchant reserves an amount against your available credit before the final payment is confirmed.
Holds are common with petrol stations, hotels, and car rental companies. For example, a petrol station may temporarily reserve RM200 on your card even though you eventually spend RM60 on fuel. The RM200 hold is not the same as a completed RM200 purchase.
If the transaction still cannot be explained after these checks, contact your bank and report it as unauthorised.
Report The Transaction To Your Bank
Contact your bank as soon as you discover an unauthorised transaction. Use the telephone number printed on the back of your credit or debit card or get the bank's contact details directly from its official website.
If you received a message about the transaction, do not call the number or click a link in that message. Scammers can impersonate banks and direct you to fake hotlines or websites. The Association of Banks in Malaysia (ABM) advises customers to contact their bank using an official channel.
When you report the transaction, have these details ready for the bank:
- Transaction date
- Transaction amount
- Merchant name
- Whether your physical card is still with you
- Whether you received an OTP, TAC, or other authentication request
- Relevant receipts, messages, or other evidence
Ask for a dispute or case reference number and keep it throughout the investigation.
Under Bank Negara Malaysia's (BNM) Policy Document on Credit Card and Credit Card-i, your bank must acknowledge the disputed transaction and inform you of the information it needs within three working days of receiving your complaint. This includes basic details such as your name, affected card number, transaction date, disputed amount, and why you believe the transaction is unauthorised.
The three-working-day period is not a deadline for the bank to finish its investigation. The bank may need to look at information from you, the merchant, the payment network, and other parties before deciding who should bear the loss.
Your bank should also update you within 14 days of receiving your complaint. Some investigations may take longer depending on the circumstances, so do not assume that your case will be resolved within those 14 days.
If Your Credit Card Is Lost Or Stolen
Report a missing card to your bank immediately. Do not wait for another transaction to appear before notifying the bank.
Your bank can block or cancel the card to prevent further use. If your banking app has a temporary card-lock function, you can use it while contacting the bank, but still report the card as lost or stolen and ask whether it needs to be replaced.
BNM's current credit card policy also gives cardholders specific protections for transactions made after the bank has been notified that a card is lost, stolen, or being used without authorisation. Similar protection applies to transactions made after you have notified the bank that your PIN or another security credential has been compromised.
Your bank may ask for a police report or other supporting documents as part of its investigation. Ask what it needs when you make the report.
If You Still Have Your Credit Card
A fraudulent transaction can happen even when your physical card is still in your wallet. Someone may have obtained your card number, expiry date, and security code and used those details for an online purchase. This is known as a card-not-present transaction because the physical card is not presented to the merchant.
Tell the bank that you still have the card when you report the transaction. If your card details may have been compromised, ask whether the card should be blocked and replaced.
The BNM's current requirements also protect in certain situations where a card-not-present transaction is processed without strong authentication. The circumstances of the transaction still have to be assessed when deciding who should bear the loss.
How The Bank Decides Who Is Responsible
The bank has to investigate the circumstances of a questioned transaction before deciding who should bear the loss. This includes looking at how the transaction was processed, what authentication was used, whether your card or security credentials were compromised, and whether the parties involved met their respective obligations.
Authentication alone does not prove that you authorised a transaction. For example, an OTP or app approval may form part of the evidence considered by the bank, but it is not the only factor used to determine whether the transaction was authorised.
The bank can hold you responsible if it has adequate evidence that you:
- Acted fraudulently
- Refused to cooperate with the investigation
- Failed to carry out the security obligations communicated to you
These obligations can include keeping your card and security credentials secure and notifying the bank after discovering an unauthorised transaction or believing that your credentials have been compromised.
If the bank asks for documents or further information, provide them as soon as you can. Keep your dispute reference number, statements, receipts, messages and copies of anything you submit.
Do You Have To Pay The Disputed Transaction?
You do not have to pay the disputed amount while the bank investigates it. The bank should also not impose finance or other charges on that disputed amount during the investigation.
This does not mean your entire credit card bill is put on hold. You remain responsible for legitimate spending on the account.
For example, if your statement contains RM2,000 of purchases you made and RM300 of spending you reported as fraudulent, the RM300 is the disputed amount.
| Statement Item | Amount |
| Legitimate spending | RM2,000 |
| Disputed transaction | RM300 |
| Total statement balance | RM2,300 |
The RM300 remains under investigation, while the RM2,000 of legitimate spending remains your responsibility. Follow your bank's instructions on how to make payments while the dispute is being investigated.
What If The Bank Rejects Your Fraud Claim
If the bank decides that you should bear the fraud loss, ask which cardholder obligation it says you breached and what evidence supports its decision. BNM requires the bank to have adequate evidence that you breached the relevant cardholder obligations before assigning the fraud loss to you.
You can ask:
- Which cardholder obligation did I breach?
- What evidence shows that I breached it?
- How did you determine that I authorised the transaction?
- Can you give me the decision and reasons in writing?
Authentication alone does not prove that you authorised a transaction. The bank cannot rely solely on whether the transaction was authenticated when determining whether it was authorised.
Once the investigation is complete, the bank must communicate its decision to you in writing, including a brief assessment of the case, the outcome and, where applicable, the basis for assigning the fraud loss to you. It must also tell you about your rights and the channels available if you want further information about the investigation.
How To Escalate Your Dispute
If the bank's final response does not resolve the dispute, you may be able to take an eligible case to the Financial Markets Ombudsman Service (FMOS).
FMOS provides a free dispute-resolution service for eligible disputes involving direct financial losses of up to RM250,000. Its scope includes unauthorised transactions involving credit cards, debit cards, internet banking and e-money.
You must complain to the financial institution first. If you receive its final decision and remain dissatisfied, you generally have six months from the date you receive the decision to refer an eligible dispute to FMOS. You may also be eligible if the financial institution does not respond within 60 days of your complaint.
When To Call NSRC 997
Call the National Scam Response Centre (NSRC) 997 when the fraud involves an online financial scam, such as being tricked into transferring money. If someone simply used your credit card without your permission, report the transaction to your card issuer and follow its dispute process.
If you have been tricked into transferring money or discover an unauthorised transfer from your bank account, contact your bank or NSRC 997 as soon as possible. The 997 hotline operates 24 hours a day, and NSRC coordinates with banks and relevant agencies to trace and attempt to stop the movement of stolen funds.
Contact your bank at the same time so it can take action on your account. Acting quickly can improve the chances of stopping or recovering the money, although recovery is not guaranteed. Have your transaction records, payment receipts, screenshots, and messages with the scammer ready when you make the report.
If you report the scam through NSRC 997, you do not need to make a separate police report at a station. Police officers at the centre can assist with the report, as Bernama reported.
For a broader guide to recognising financial scams and what to do if you become a victim, read How To Spot A Financial Scam And What To Do If You're A Victim.
Protect Your Card After Fraud
Reporting the transaction is only part of dealing with card fraud if your card details may have been exposed. You should also reduce the chance of further unauthorised transactions.
Check Your Statements And Transaction Alerts
Keep transaction alerts enabled so you can spot unusual spending quickly. Check your statements regularly too, particularly after your card details have been compromised.
A small charge can be easy to dismiss, but it may be an early sign that someone has obtained your card details. For example, you might notice a RM5 online transaction from a merchant you do not recognise, followed by a larger purchase a few hours later. Checking your alerts and statements regularly gives you a better chance of spotting further unauthorised activity early.
Secure A Compromised Card
If your physical card is still with you but its details may have been exposed, use your bank's kill switch to temporarily suspend the card if one is available. Then contact your bank to report the fraud and ask whether you need a replacement card.
You should also remove the compromised card details from websites, shopping apps, and digital wallets where you no longer need them.
Be Careful With Payment Links
Do not enter your card details through an unexpected payment link. Scammers can use phishing links and imitation websites to collect banking and card information.
If you receive a payment link through SMS, email, WhatsApp, or social media, open the merchant's official website or app yourself instead of following the link.
Check the website address before entering your card details. HTTPS encrypts the connection, but it does not prove that the website belongs to the merchant you intended to visit.
Keep Your Security Credentials Private
Never share your PIN, password, TAC, or OTP with someone who contacts you unexpectedly. Banks do not ask customers to disclose these credentials over the phone or through links.
If someone claims to be from your bank and asks for a security code, end the conversation and contact the bank using the official number on your card.
What To Do Based On Your Situation
Different types of credit card fraud require different responses. Use this table as a quick reference.
| Your Situation | What To Do |
| You do not recognise a transaction | Check the merchant name, receipts, and transaction status |
| The transaction is pending | Check whether it could be a temporary pre-authorisation hold |
| The transaction is unauthorised | Contact your bank and lodge a dispute |
| Your card is lost or stolen | Report it immediately and ask the bank to block or cancel it |
| Your card is still with you but was used online | Report the transaction and ask whether the card should be replaced |
| You were tricked into transferring money | Contact your bank or NSRC 997 immediately |
| The bank rejects your fraud claim | Ask for the decision and reasons in writing |
| You disagree with the bank's final decision | Make a formal complaint and consider FMOS if eligible |
Frequently Asked Questions
What If I Only Notice The Fraud Months Later?
Report it to your bank as soon as you discover it, even if the transaction is months old. A delay does not mean you should ignore it or assume nothing can be done.
The timing may form part of the bank's investigation, as cardholders are expected to notify the bank after discovering an unauthorised transaction. If you only noticed the charge while reviewing an old statement, explain when and how you discovered it.
What If I Shared My OTP With A Scammer?
Tell your bank exactly what happened, including whether you entered an OTP, TAC, or another security credential. Sharing an OTP does not by itself settle who is responsible for the loss. The bank still has to consider the circumstances and whether you failed to meet the security obligations attached to your card.
Do not leave out the OTP when explaining what happened. If the incident involved an online financial scam or you were tricked into transferring money, contact your bank or NSRC 997 as soon as possible.
Will A Fraud Dispute Affect My CCRIS Record?
A fraud dispute is not the same as missing a payment on legitimate credit card spending. CCRIS records credit information reported by participating financial institutions; it does not decide whether your fraud claim is valid.
If you believe information reported about your credit card account is inaccurate, raise the issue with the relevant bank and ask it to verify or correct the information. While the dispute is being investigated, follow the bank's instructions for the legitimate, undisputed part of your balance rather than stopping all payments.
Can I Still Use My Credit Card While The Dispute Is Open?
Ask your bank before using the card again if you are unsure whether its details are still safe. If there is no indication that your card details were compromised, the bank may leave the card active. If the details may have been stolen, it may block the card and issue a replacement.
If the card has been blocked or cancelled, do not attempt to use it.
Do I Need A Police Report For Credit Card Fraud?
For an ordinary unauthorised credit card purchase, start by reporting the transaction to your bank. The bank may ask for a police report or other documents as part of its investigation, so ask what it requires.
If the incident involves an online financial scam, contact your bank or NSRC 997 as soon as possible and follow the reporting instructions given to you.
What If The Bank Says I Authenticated The Transaction?
Ask how the authentication was considered as part of the wider investigation. Entering an OTP, approving a notification or completing another authentication step does not by itself prove that you authorised the transaction. The circumstances surrounding the transaction still have to be considered.
If the bank rejects your claim on this basis, ask for its decision and reasons in writing. You can then decide whether to make a formal complaint or refer an eligible dispute to FMOS.
