Since 2020–21, KPKT has allowed licensed moneylenders to offer loans online under specific Online Money Lending Guidelines, with a separate permit and added cybersecurity and identity-verification requirements. So a digital lender can be perfectly legal. The problem is that the same convenience attracts illegal operators, and in 2026 many loan sharks have swapped street posters for slick mobile apps.
What a legitimate online lender still must do
- Hold a valid KPKT moneylending licence plus the online-lending permit.
- Use a proper Schedule J/K agreement, executed digitally, with the terms explained to you.
- Stay within the 12–18% p.a. caps and charge simple interest only.
- Never demand your ATM card, banking password, or an upfront “processing fee” to release the loan.
Approval with no checks at all; an upfront fee before disbursement; demands for access to your phone contacts or gallery (used later to harass you); interest that compounds or exceeds the cap; and no verifiable KPKT licence. Any one is reason to stop.
The contacts-harvesting trap
A signature move of illegal lending apps is requesting access to your phone’s contacts at sign-up. If you later miss a payment, they threaten to message everyone you know. A licensed lender has no need for your contact list — that permission request alone should end the conversation.
Treat any suspicious app as a potential scam: don’t pay, uninstall, and report. The scam-response playbook →
Going deeper
The permissions trap in illegal loan apps
The defining danger of an illegal lending app isn’t just a bad rate — it’s what the app asks to access. A signature move is requesting permission to read your phone contacts, photos or messages at sign-up. The reason is sinister: if you later miss a payment, the operators threaten to message everyone you know, or worse. A licensed online moneylender, bound by KPKT’s guidelines and cybersecurity requirements, has no legitimate need for your contact list. That permission request alone should end the conversation.
Legitimate online lending does exist — KPKT has allowed licensed moneylenders to operate digitally under specific guidelines since 2020–21, with a separate permit and added safeguards. The trick is telling the regulated app from the predatory clone.
The instant-approval app that wants your contacts
At sign-up it asks for: contacts + photos access
Then demands a RM150 'processing fee' before payout
————————
Three red flags at once: no checks, data grab, upfront fee
Verdict: uninstall and report
No-questions approval, contact-list harvesting and an advance fee are the trademarks of an illegal lending app. A licensed lender does none of these.
Tips for spotting a legal online lender
Online-lender checklist
- Valid KPKT licence plus online-lending permit
- No request for contacts, photos or messages
- No upfront processing fee
- Proper Schedule J/K digital agreement
- Rate within 12–18% p.a., simple
- App from an official store, genuine developer
Frequently asked questions
Can licensed moneylenders legally lend online in Malaysia?
Yes. Since 2020–21 KPKT has allowed licensed moneylenders to offer online loans under specific guidelines, with a separate permit and added cybersecurity and identity-verification requirements.
Why do illegal loan apps ask for my contacts?
So they can threaten to message the people you know if you miss a payment. A licensed lender has no legitimate need for your contact list — that request is a major red flag.
Is an upfront fee normal for an online loan?
No. A demand for a ‘processing fee’ before the loan is disbursed is a classic advance-fee scam.
How do I check an online lender is legitimate?
Confirm the KPKT licence and online permit, insist on a proper Schedule J/K agreement, check the rate against the cap, and refuse any app demanding contacts access or an upfront fee.