TAC/OTP Hijacking — How Scammers Steal Your Banking Code

Transaction Authorization Code (TAC) and One-Time Password (OTP) hijacking is not a standalone scam — it is the final step in almost every banking fraud in Malaysia. Whether the initial contact is a Macau Scam call, a phishing SMS, or a fake banking app, the scammer's ultimate goal is to obtain your TAC or OTP to authorize fraudulent transactions.

Malaysian banks use TAC and OTP as the last line of defence for online transactions. Once a scammer obtains this code, they can transfer your money out within seconds.

Scammers use several methods to obtain your codes. The most common is social engineering — calling or messaging you while posing as a bank officer, police officer, or BNM official. They claim there is a problem with your account and ask you to read out the TAC code "for verification."

More sophisticated methods include SIM swap attacks, where scammers convince your telco to transfer your phone number to a new SIM card, allowing them to receive your TAC messages directly. Malware-infected apps can also intercept SMS messages silently.

Some phishing websites display a fake "verification" page that asks you to enter the OTP you just received, which is then used in real-time to complete a fraudulent transaction on the real banking site.

Will my bank ever ask for my TAC or OTP?

No. Malaysian banks explicitly state they will never ask for TAC, OTP, PIN, or passwords via phone, SMS, or email. Any such request is a scam.

What should I do if I accidentally shared my OTP?

Call your bank's fraud hotline immediately to freeze your account. Then call 997 (NSRC) and lodge a police report.