Touch 'n Go eWallet Hacked in Malaysia: What to Do First

You open your Touch 'n Go eWallet and the balance is lower than it should be. There are payments you never made, a transfer to a name you do not know, or a Google Play charge you did not approve. Many people search for this as "TNG kena hack" or "TNG eWallet 被盗", usually minutes after they notice.

The short answer: lock the wallet first, report second, and tidy up third. Kill Switch in the app stops every transaction until you reactivate it. After that you report to TNG Digital, your bank, NSRC 997 and the police, in that order, depending on whether money has already gone.

This guide covers how to tell a hacked wallet from a scam, the official routes in Malaysia, what TNG will not refund, how takeovers happen, and the steps for a Grab account.

Last checked: 29 September 2026.

#What Should You Do First If Your Touch 'n Go eWallet Was Hacked?

Turn on Kill Switch in the TNG eWallet app to lock the account. If you cannot open the app, call the TNG Careline and choose the fraud option. Then report the transactions to TNG Digital through the Chatbot, call your bank to block any card linked to the wallet, and call NSRC on 997 if money has moved. Make a police report after that. Do not give a PIN or OTP to anyone who calls you about it.

#Hacked, Scammed or Linked? Work Out What Happened

TNG Digital treats these situations differently, and the difference decides whether a refund is possible. Its help centre explains that an unauthorised transaction and a scam are not the same: an unauthorised transaction is one someone made without your knowledge or approval, while a scam is one you approved yourself after being misled.

TNG explains the Cooling-Off message and Account Access Temporarily Limited on separate pages, and says it may not be able to disclose every reason for a limit.

#Step One: Lock the Wallet With Kill Switch

TNG describes Kill Switch as a self-service feature that immediately locks your account in an emergency or when you suspect unauthorised access. Its activation steps are Settings, then Security, then Kill Switch, followed by a series of confirmations. The account locks as soon as you confirm. TNG's help centre also calls this the "Deactivate Account" feature, and menu labels can vary by app version.

• After activation, you cannot send or receive money, make payments or open the account. That includes toll and parking paid through RFID and PayDirect, so plan your drive home.
• TNG says Kill Switch does not delete your account or funds. It only locks the account until it is reactivated.
• To reactivate the account, you contact the Chatbot and complete a security verification with the Careline.
• Kill Switch cannot be customised. TNG points to separate steps for deactivating the Visa prepaid card and auto debit transactions.

If your phone was stolen or you cannot get into the app, TNG's Security Centre gives the Careline as +603-5022 3888, open 7am to 10pm for general enquiries, and says to select "*" for fraud at any time. Take the number from TNG's own site, never from an SMS, a search ad or a social media comment.

#Step Two: Report to TNG Digital, Your Bank and NSRC 997

If money is moving right now, call your bank or 997 before anything else. Otherwise, report in this order.

1. Report to TNG Digital through the Chatbot. TNG's page on reporting suspicious or fraudulent activity covers charges you did not make, someone using your wallet without approval, and payments you were tricked into making.
2. Submit an Unauthorised Transaction Report if the transaction was not yours. TNG says you must be the account owner and report within 90 days with the documents it asks for.
3. Call your bank's 24-hour hotline if you reload the wallet with a bank card, and ask them to block the card. The hotline is on the back of the card and on the bank's website.
4. Call NSRC on 997 if money has already gone. TNG's help centre says to contact NSRC within 24 hours because that improves the chance of stopping the money moving further, and that one report per case is enough if you already reported the same transaction to NSRC.
5. Make a police report at the nearest station after the bank or 997 call.

TNG says it will investigate and update you within 14 days. If it confirms the transaction was not made by you and was not a scam, you get a full refund, and TNG says an approved refund arrives within five working days with the result sent to your registered email.

The NSRC's own FAQ on the NFCC website says to make the police report within 24 hours, because the police cannot follow up without one. It says acting quickly can reduce losses but there is no guarantee the money comes back, and that follow-up goes through the investigating officer, not 997.

#Evidence to Gather Before You Call

Based on the NSRC's list, have these ready:

• A short timeline in plain sentences: what you noticed, when, and what you have done since.
• Your name, phone number and MyKad number, plus the bank account or card linked to the wallet.
• Screenshots of each transaction in the TNG eWallet history, with the date, time, amount and recipient visible.
• Any SMS, call log, chat, email or link that came before the transactions, including the address of any page where you typed a PIN or code.
• Reference numbers from TNG, your bank and NSRC.

#What TNG Will Not Refund

TNG's list of cases not considered unauthorised includes:

• You shared your eWallet login or OTP with someone else.
• A scam or phishing payment that you authorised yourself, or a transfer made by mistake.
• Use of a rooted or jailbroken phone, an unofficial app version, or a device infected with malware or a suspicious APK file.
• Recurring payments you authorised, such as auto debit with Apple, TikTok or a bill payment.
• Letting someone else use your bank card to reload a TNG eWallet account.

#How Touch 'n Go eWallet Takeovers Happen

Most wallet losses start with a trick, not a technical break-in. TNG's blog on digital wallet security goes further and says scammers usually try to get you to link your eWallet to another platform, such as Google Play, the Apple App Store or Lazada, then spend your balance from there without logging in to the wallet at all. These are the patterns TNG and Grab describe:

• OTP phishing calls. TNG's Security Centre says scammers call pretending to be company staff, "verify" you with details like your IC number or vehicle number, then ask for your SMS OTP.
• Malicious apps. TNG says fake apps arrive through chats, links and attachments, ask to become your default SMS app, and can then read your SMS, TAC and OTP. Some show a fake payment page to steal your details.
• Fake customer service, police or bank staff. TNG's blog says impersonators claim your account is under investigation to scare you into giving your 6-digit PIN or OTP.
• Linked payment methods. A tricked "verification" can quietly add your wallet as a payment method elsewhere. TNG says you can check active agreements under Permission & Auto Debit in the app settings.
• SIM swap. If someone moves your number to a SIM they control, codes sent by SMS follow it. Our guide to a SIM swap in Malaysia covers the telco side.

TNG's Security Centre says each eWallet is tied to one phone, and that signing in on a new device with a less secure method brings limited transactions for up to 48 hours. That is why a Cooling-Off message you did not cause deserves attention. If you tapped a link or installed something first, our guide on what to do after clicking a phishing link covers cleaning up the phone.

#If Your Grab Account or GrabPay Was Used Without Permission

Grab works a little differently. Its Malaysian GrabPay security page lists what it treats as suspicious: a GrabCar, GrabFood or GrabExpress booking you did not make, an email asking you to verify an address you never changed, GrabRewards points spent without your consent, and GrabPay Wallet deductions for transfers or purchases you did not authorise.

1. Reset your Grab password or GrabPIN, as Grab advises if you shared your login or see charges you do not recognise.
2. Report it through the Help Centre in the Grab app. Grab's payment terms ask you to notify it there immediately about fraudulent activity or stolen funds.
3. Raise the complaint quickly. The same terms say complaints and disputes should be raised within one month of the transaction or of you becoming aware of the fraudulent use, whichever is earlier.
4. If you gave card details to a fraudster, block the card through your bank, or in the Grab app for a GrabPay Card, and make a police report. Call 997 if money has moved.

Grab's Trust and Safety page says it emails you when a device change is detected or a new social account is linked, so act on any such alert you did not cause. Grab also says it never asks for your password or OTP over calls, SMS or email.

#Scams to Avoid After Your Wallet Is Hacked

People who have just lost money are targeted again, with calls and comments offering to "recover" the funds.

Watch for offers to rent or lend your eWallet as well. TNG's Security Centre describes a mule account as one used to receive and transfer illegally obtained funds, and warns that you could face legal action if illegal transactions are found in your account. If your own account has been restricted over funds you received, speak to TNG and, where needed, a lawyer.

#Lock It Down Once the Dust Settles

• Complete every item in your eWallet security status, as TNG's Security Centre recommends, so every protective feature is active.
• Set a new, unique PIN, turn on biometric login and turn on transaction notifications.
• Check Permission & Auto Debit and remove anything you did not set up. Also remove TNG eWallet as a payment method in your Apple ID or Google Play settings if you did not add it.
• Secure the email and phone number tied to the wallet, because they are the recovery path. Our guide to reporting a hacked account in Malaysia lists the official routes for other accounts.
• Report phishing links to TNG, and computer security incidents to CyberSecurity Malaysia's Cyber999, the national point of contact for them.

#When a Case Review Makes Sense

For the money itself, the right routes are TNG Digital, your bank, NSRC on 997 and PDRM, and you can do all of it yourself with this guide. We do not recover funds, unfreeze wallets or bank accounts, or deal with TNG, banks or the police on your behalf. TNG, Grab and your bank make every refund decision, and some losses are not recovered.

Where outside help can make sense is afterwards, if the same attacker also got into your email, Google or Apple account, WhatsApp or social media, and you are locked out of several at once. SocialSafe by AwareXone reviews that kind of case first and tells you if you already have what you need. You can read how our account security service works, and our Trust Center explains that we never ask for your password or login codes.

#Frequently Asked Questions