E-Wallet Scam Refunds In Seven Working Days: What That Promise Actually Covers

About this guide: This explainer uses an incident reported on 2026-07-01 as a starting point. The legal rules below are general; they do not decide anyone's guilt, liability or individual case.

What happened

The sentence that travelled fastest was the short one: an e-wallet operator that has not put Bank Negara Malaysia's anti-fraud safeguards in place must repay a scam victim in full within seven working days. It came from Parliament on 1 July 2026, in a written reply by Prime Minister and Finance Minister Anwar Ibrahim to MP Roy Angau Gingkoi, reported the same day by The Star and by Malay-language outlets. As reported, the seven working days run from the day the operator receives your complaint, not the day the money left your account.

The reply listed the safeguards an e-money issuer is expected to have: stronger transaction authentication rather than plain SMS one-time passwords, a cooling-off period before high-risk transactions, binding an account to a single registered device, a dedicated fraud hotline, and a kill switch that lets you freeze your own account. These were pushed onto the banks first; the point of the July announcement was that eligible e-money issuers face the same expectations. The duty was said to apply even where the loss was partly caused by the user's own carelessness.

The reply came with numbers: RM1.2 billion in fraudulent transactions blocked, and a 26 per cent rise in victims receiving full or partial compensation after the measures were fully implemented. It also pointed to the machinery behind them — the National Scam Response Centre (NSRC) for rapid response, the National Fraud Portal for tracing and freezing funds, and the Financial Markets Ombudsman Service (FMOS) for consumers who disagree with a provider's decision.

The next day, consumer groups pressed on the fuzzy part. Fomca, through secretary-general Saravanan Thambirajah, asked Bank Negara for a standardised way of assessing negligence, objective criteria rather than each provider's own reading, fixed timelines for handling complaints, and written reasons with evidence when a claim is rejected. Pertubuhan Mesra Pengguna Malaysia's deputy president Azlin Othman backed the policy but stressed that security remains a shared responsibility. Note too that no new Act was passed: this was a written answer describing supervisory requirements Bank Negara already imposes.

The legal insight: what law applies

Bank Negara's requirements on banks and e-money issuers live in policy documents and standards issued to regulated institutions, not in a section of a statute you can quote to a magistrate. They bind the institution as a matter of financial regulation, and the regulator can act against a firm that ignores them. What they generally do not give you is an automatic personal entitlement enforceable by citing a paragraph number. In practice your route is to complain, ask the operator to answer, and escalate if the answer is unsatisfactory.

There is a real difference between two things people lump together as 'kena scam'. In an unauthorised transaction someone else moved your money — a stolen phone, a hijacked account, a malicious app. In an authorised one you pressed confirm yourself because someone convinced you to. The seven-working-day rule as described is triggered by the provider's failure to implement the required safeguards, and is expressed to apply even where user negligence contributed. Generous, but conditional on that failure. If the safeguards were in place and working, you are back in shared-responsibility territory.

If the operator says no, the escalation route is FMOS. Its published scope covers banking and Islamic banking disputes including unauthorised transactions via ATM, debit or credit card, internet banking or e-money, with a RM250,000 limit on direct financial loss, and it is free for consumers. You must complain to the institution first. You may then file within six months of receiving its final decision, or where it fails to respond within 60 days of the dispute first being raised with it. FMOS will not take matters already in court or arbitration, or matters outside the limitation periods under the Limitation Act 1953.

The FMOS process has two stages. A case manager attempts mediation, negotiation or conciliation within about three months, and issues a written recommendation within 30 days if that does not settle it. If either side rejects the recommendation, the Ombudsman adjudicates, aiming to decide within 14 days of receiving complete documents. That decision binds both you and the member only if you accept it; reject it and the process simply ends, with no appeal inside the scheme. FMOS targets three to six months overall.

How does this impact me?

Picture a Friday evening call about a parcel stuck at customs. Forty minutes later RM8,000 has left your e-wallet in three transfers. Under the position described on 1 July 2026, what matters is not only whether you were careless, but whether that operator actually had the required safeguards running on your account — real authentication, a cooling-off period, device binding, a reachable fraud hotline, a kill switch. Those are concrete, checkable things, and worth asking about in writing.

A different case: your phone is snatched, and within twenty minutes the balance is gone and a credit line drawn down. That is closer to a classic unauthorised transaction, where the device-binding and authentication requirements bite directly. A kill switch you could not find or could not use is a fact worth stating plainly in your complaint.

None of this promises you a refund. What the announcement gives you is a standard to measure the provider against, a timeline to hold it to, and a free independent forum if its final answer disappoints. Above RM250,000 you would be looking at the courts instead. Start the seven-day clock deliberately: complain in writing, by in-app ticket or email, so the date of receipt is on record. A late-night phone call nobody logs is hard to prove three months later.

What this incident teaches us

The biggest misreading is treating a parliamentary written reply as a new law. Parliament passed no E-Wallet Refund Act; a minister described requirements the central bank already imposes on the institutions it supervises. That shapes your complaint: you are asking the operator to meet a regulatory standard and explain itself, not suing under a section of an Act.

The second is hearing 'full compensation even if you were negligent' and stopping there. The duty as described is tied to the provider failing to implement the prescribed measures. Fomca's call for a standardised negligence framework exists precisely because, without published criteria, providers may weigh your share of the blame differently. Until that is spelled out, expect variation — and expect the written reasons for a rejection to be the document that matters most.

In scam cases speed usually beats legal rights. Once money passes through two or three mule accounts, the practical chance of tracing it falls away. The fastest things you control are the 997 call and freezing your own account. Build the paper trail from minute one — timestamped screenshots, recipient account numbers, the complaint reference, the operator's replies — because the disputes that go badly are the ones where the consumer remembers clearly but cannot evidence it.

The verdict

This is a genuine strengthening of consumer protection, but read it as conditional rather than automatic. The seven-working-day full-reimbursement duty described in Parliament on 1 July 2026 bites where an e-money issuer has failed to implement Bank Negara's prescribed safeguards. Whether that covers your loss depends on facts about your account and your provider that only a written complaint will surface. If the answer disappoints, FMOS is free, independent, and bound by a six-month clock you should not let run out.

What can I do if this happens to me?

• Call 997 immediately. In March 2026 the government said a 997 call to the National Scam Response Centre is treated as a police report, so you need not queue at a station first. Write down the reference number, date and time.
• Freeze what you still control: use the kill switch or account-freeze function, change your passwords, and check for unfamiliar linked devices. If your SIM or phone was involved, contact your telco too.
• Preserve evidence before it disappears — timestamped screenshots of each transaction, recipient account numbers or wallet IDs, messages, call logs and in-app notifications. Export or photograph them so they survive a phone reset.
• Complain to the operator in writing, not only by phone, so the date of receipt is recorded. Ask specifically whether the required anti-fraud safeguards were active on your account, and ask for a written final decision with reasons.
• Diarise three dates: seven working days from the operator's receipt of your complaint, 60 days from when you first raised the dispute, and six months from its final decision. Those windows decide what options stay open.
• If the answer is unsatisfactory or none comes, file with FMOS at fmos.org.my — free, covering unauthorised e-money transactions, capped at RM250,000 in direct loss. Take legal advice if the loss exceeds that cap or involves a business account, and note that FMOS will not take a matter already in court or arbitration.