KUALA LUMPUR (Sept 21): Bank Pertanian Malaysia (Agrobank) suffered losses of RM203.8 million from close to 3,000 unauthorised transactions carried out between Oct 28 and Nov 3, 2025, according to an affidavit filed in court.
The bank found that unauthorised messages and/or instructions had been sent through its Application Control Interface (ACI) connector to PayNet, instructing that funds be credited to beneficiary accounts at various banking institutions.
Agrobank said its Digital Banking Department was alerted on Nov 3, 2025, after its Corporate Channel Operations Department reported unauthorised transactions through the Real-time Retail Payments Platform (RPP) between Oct 31 and Nov 2.
The volume of RPP transactions during this period increased sharply compared with previous weekends, recording a net outflow of more than RM85 million, which had never occurred before the incident.
The bank subsequently conducted a preliminary investigation and found that the transaction amounts and details recorded in its host system did not match PayNet's RPP report.
Further checks found that some of the account numbers involved did not exist in Agrobank's banking database.
The bank also found that unauthorised messages and/or instructions had been sent through its Application Control Interface (ACI) connector to PayNet, instructing that funds be credited to beneficiary accounts at various banking institutions.
Agrobank said the incident did not affect its customers' accounts, as the transactions involved the bank's settlement account.
It said the money transferred through the unauthorised transactions was therefore Agrobank's funds and not customer funds.
Agrobank lodged a police report on Nov 5, 2025, stating that unauthorised instructions had been sent through its ACI connector to PayNet, resulting in the bank's funds being credited to beneficiary accounts at various financial institutions.
The transactions involved 1,644 Agrobank accounts, 881 beneficiary account numbers across 20 banking institutions and 2,973 transactions worth a total of RM203.82 million.
Following further internal investigations, the bank lodged a second police report on Nov 17, 2025, detailing additional unauthorised transactions identified between Oct 28 and Oct 30.
The police subsequently investigated the unauthorised transactions and beneficiary accounts involved.
A total of 1,903 accounts were subsequently frozen under Section 116D(2) of the Criminal Procedure Code, involving RM16.929 million.
On Monday, the Sessions Court ordered RM1.505 million from 60 of those accounts to be returned to Agrobank, in its first recovery of the funds. Agrobank’s counsel Datuk Baljit Singh Sidhu and Gupreet Kaur Pannu filed the application on Aug 11, seeking the return of funds traced to the 60 accounts.
Earlier this year, Home Minister Datuk Seri Saifuddin Nasution Ismail said Agrobank suffered losses of RM203.8 million due to online fraud reported in November last year.
Police have arrested 47 individuals in connection with the case, with three charged under Section 424C(1) of the Penal Code over offences involving mule accounts.
Bank Negara Malaysia has also been investigating the case. It previously said that no customer funds were affected and no customer data was compromised.