Am I liable for what happened to my account

Liability is rarely a simple yes or no

Whether you are considered liable for what happened to your account depends on the specific circumstances, not a single rule that applies to everyone. Banks look at how the access or transaction occurred before reaching a conclusion.

Being deceived into an action is treated differently from carelessness. Entering a one-time password on a fake page you believed was genuine is not the same as sharing a password with no prompting at all. The distinction matters, even though both can feel the same afterward.

This is why getting a clear picture of what actually happened, and when, is the first useful step before worrying about the outcome.

What banks typically look at

A bank reviewing a case like this usually considers how convincing the deception was, and whether you were following what looked like a legitimate instruction. It also checks whether any of the bank’s own security warnings were bypassed or ignored, since each factor shifts the picture.

Account takeover cases, where someone gains control without your knowledge at all, are generally viewed differently from cases where you were manipulated into approving a transaction yourself. Both can feel like a loss of control to you, but banks treat the two situations differently.

Banks also weigh whether you reported the issue promptly once you realised something was wrong, since a fast report suggests genuine victimisation rather than negligence.

Why the deception itself matters

Modern scams are designed to look exactly like legitimate bank communications, complete with matching logos, familiar language, and urgency that mirrors real security alerts. Falling for a well-executed version of this is not the same as ignoring an obvious warning sign.

If you can show what the fake message or page looked like, this becomes important evidence for your case. It demonstrates how the deception actually worked, rather than leaving it to assumption.

If you disagree with the bank’s initial view

You are not required to accept the bank’s first assessment as final. Escalating a bank complaint through the proper channels gives you a chance to have the decision reviewed by Bank Negara Malaysia or the Ombudsman for Financial Services.

A police report also supports your position, since it creates an independent record of what you reported and when, separate from the bank’s own file.

What to do next

Write down exactly what happened, including screenshots of any message or page that deceived you, before your memory of the details fades. This record supports both your bank complaint and any escalation that follows.

If you are unsure how your specific situation is likely to be assessed, a short conversation can help you understand the realistic picture before you respond to the bank.