Fake loan apps: the red flags before your duit disappears

Red flag 1: a fee before the loan

The names change but the structure never does. Processing fee. Insurance. Stamp duty. Legal fee. Release fee. Tax clearance. Account activation. Some scripts even use a "refundable deposit to prove you can repay."

What happens next is predictable: you pay, and a new obstacle appears. The transfer failed because your account name has a typo — pay a correction fee. The system flagged your file — pay a clearance fee. Each payment is justified by the money you have already sunk, which is exactly the point.

If you have paid once and are being asked again, stop there. The first payment is gone; the second one does not bring it back.

Red flag 2: they want your card, PIN or OTP

Some fake lenders ask you to hand over your ATM card and PIN "as collateral", or to read out an OTP "to verify the disbursement". Others ask for your online-banking username and password so they can "check your account eligibility".

The NFCC states the position plainly: legitimate parties will not at all ask for your personal banking information — username, password, PIN, TAC or OTP. There is no exception to this for lenders. Anyone who asks is either running a scam or preparing to use your account as someone else's, which is its own serious problem.

Red flag 3: the app comes from a link, not a store

Practical guidance, not a regulator's checklist. The points in this section are our own advice based on how these scams typically operate, rather than claims taken from an official source.

Be very careful when a "lender" sends you an installation file directly — through WhatsApp, Telegram or a download link — rather than pointing you to the official Google Play Store or Apple App Store listing. Installing software from outside the official stores bypasses the checks those stores perform.

Watch the permissions too. A loan application has no business reading your entire contact list, your photo gallery or your SMS messages. Do not grant permissions you do not understand. A lender should be able to explain, in writing, why each item of information is needed and how it will be used.

Malware is a recognised scam method in Malaysia — the NFCC lists malicious software attacks alongside phishing and Macau scams among the fraud methods NSRC deals with. An app you sideloaded from a stranger's link is the easiest way to invite one in.

Red flag 4: a licence that doesn't survive checking

Fake lenders produce impressive documents: certificates with ministry crests, screenshots of "approval letters", BNM or KPKT logos pasted into a Facebook page. A logo is not a licence. The document is only worth what the official record says.

It helps to know who licenses what, because scammers routinely get this wrong in ways you can spot:

• Banks are licensed and regulated by Bank Negara Malaysia.
• Moneylenders — officially "kredit komuniti" since the sector was rebranded, with KPKT's division renamed Bahagian Kawalan Kredit Komuniti on 1 June 2019 — are licensed by KPKT under the Moneylenders Act 1951 (Act 400) and its regulations.

So a "Bank Negara moneylending licence" is a document that cannot exist. Someone waving one has told you what you needed to know.

How to check, properly

1. Search the official KPKT app

KPKT publishes a free app called i-KrediKom. According to the ministry, it lets the public search for licensed credit-community companies, lodge complaints and check complaint numbers, and read up on borrower rights and the offences set out under the Moneylenders Act 1951 and its regulations.

Search by company name or licence number, and match what you find against the name on whatever agreement you are being asked to sign. A mismatch between the licensed entity and the party actually taking your money is a serious problem, not an administrative detail.

2. Check BNM's Financial Consumer Alert List

BNM maintains this list as a guide to entities or schemes that may have been wrongly perceived or represented as being licensed or regulated by BNM. If the outfit you are dealing with appears there, you have your answer.

But read BNM's own caveat carefully, because it matters: the absence or removal of an entity from the list should not be taken as confirmation that it is or has been licensed or regulated by BNM. Not being on a blacklist is not the same as being on a licence register. Use the KPKT search as your positive check; use the alert list as an additional negative one.

3. Ask to see the licence — and the advertising permit

Ask for the licence number, then verify it yourself in the app rather than accepting a photograph. Verify from the official source, not from anything they send you.

Our guide to verifying a licensed moneylender walks through this step by step.

Licensed moneylender or ah long?

The difference is not tone or friendliness — plenty of unlicensed lenders are extremely pleasant until the first missed payment. The difference is legal status and what follows from it.

A licensed credit-community operator holds a KPKT licence, is bound by the Moneylenders Act 1951 and its regulations, is subject to the Moneylenders Act 1951 and its regulations. KPKT's stated function is to ensure that only credit providers who are qualified, capable and ethical are licensed at all — and where an operator misbehaves, you have somewhere to complain.

An ah long has none of that. There is no KPKT licence to verify and no KPKT complaint route for that unlicensed activity. Do not treat a friendly salesperson or a convincing certificate as proof that the activity is legal. Our moneylenders guide covers the licensed sector and its rules in more detail, and our loans overview compares the legal ways to borrow.

If it has already happened

First, stop paying. Whatever has gone, has gone; further payments only add to it.

Then preserve everything before it disappears: the app listing or download link, the chat history, the phone numbers and account numbers you paid into, every transfer receipt, the "certificates" they sent you, and the social media page or advertisement that started it.

Where to take it depends on what happened:

• Money was transferred out. BNM's guidance for scam victims is to call your bank's scam hotline or NSRC at 997, and lodge a police report. Our scams section sets out that sequence.
• A licensed operator behaved improperly. Complain to KPKT — through the ministry's SISPAA complaints system, the i-KrediKom app, or the Bahagian Kawalan Kredit Komuniti directly at bkkk@kpkt.gov.my.
• An outfit is falsely claiming BNM authorisation. BNM asks the public to report illegal or suspicious entities to BNMTELELINK on 1-300-88-5465 or bnmtelelink@bnm.gov.my.

And be ready for the follow-up approach. People who have just lost money to a fake lender are frequently contacted by a "recovery agent" who wants a fee to get it back. That is the same trade, second round.