Malaysia Airlines Data Breach: 5 Scam Scripts to Expect

On 31 October 2026, Malaysia Airlines warned that some customer data processed through its reservation provider, Amadeus, between August 2023 and September 2026 may have been exposed. The airline says there is no evidence that financial information was accessed. But booking records can show your name, booking reference, flight, date and route. So a scam message may now quote your real trip, and that alone no longer proves it is genuine. Below are the five fake messages to expect, the red flag in each, and the 60-second check that works even when the scammer knows your seat.

What Malaysia Airlines said, and what it left out

According to Malay Mail and The Vibes, the airline’s statement, issued on Saturday 31 October, says:

• Amadeus, the third-party provider of its reservation system, had a cybersecurity incident.
• Certain personal information processed through Amadeus between August 2023 and September 2026 may have been exposed. That is roughly 37 months, as The Rakyat Post notes.
• The airline’s own IT systems were not compromised.
• There is “currently no evidence” that customers’ financial information was accessed.
• Customers should stay alert to suspicious or unsolicited messages, especially ones asking for personal or financial details.

Two things are missing: how many customers are affected, and exactly which data fields were involved. The Rakyat Post reports that booking details such as routes, dates and seat numbers were visible. Neither the Malay Mail nor The Vibes report on the statement lists specific fields, so treat that detail as reported, not confirmed by the airline.

Amadeus’s own October statement describes a vulnerability in a “travel booking display environment”. It says certain booking-display data was accessible, that there is no evidence payment or financial data was accessed, and that its investigation continues.

What other airlines’ notices tell us about the data

Other airlines in the same incident gave more detail. Their notices show what an Amadeus booking record can contain:

• Cathay Pacific (official notice): around 53,000 bookings. Most records held a booking reference, passenger name and flight details. A smaller subset also had email and phone contacts, travel document numbers and/or frequent flyer numbers. Access came through login credentials for an Amadeus system account.
• Japan Airlines (BleepingComputer): about 92,000 customers. Around 90,000 had reservation codes, names, flight dates, routes and travel classes exposed. About 2,000 also had email, phone, passport and frequent flyer numbers, plus flight, ticket and seat numbers. JAL said credit card numbers and passwords were not affected.
• ANA (ID Tech): about 37,800 customers, with names, reservation numbers, travel dates and flight segments.

Those numbers belong to Cathay, JAL and ANA. Malaysia Airlines has not published a figure.

Takeaway: If you flew Malaysia Airlines between August 2023 and September 2026, assume someone may know your name and trip details. There is no evidence your card data was taken.

Why “they don’t know my details” no longer works

Most scam texts are blind guesses. A wrong-number text scam starts with “Hi, is this Amy?” because the sender knows nothing. This breach breaks the habit of spotting that.

A message that says “your 14 March flight to Kota Kinabalu” sounds real because the facts are real. Scammers who have booking data skip the guessing stage. They go straight to the request, just as fake “police” in the SIMBA scam call script quote your IC number to sound official.

Change the test. Don’t ask “do they know my details?” Ask “what do they want me to do?”

Takeaway: Real details prove nothing now. Judge every message by its request: a link, a payment, a code or a login.

The script: 5 fake messages to expect

These are invented examples written by HotStakes for recognition only. They are built from the data types listed above and from patterns airlines have warned about before: fake refund agents on social media (The Vibes, 2023) and impersonators asking for “personal details, payment information” or pushing “fraudulent links” (Malaysia Airlines warning, April 2025). We have not received these messages. Names, numbers and links are made up.

1. “Your flight was cancelled. Refund pending.”

EXAMPLE (invented): “AirRefund-Desk: Dear [your name], flight [your real flight] on [real date] was cancelled due to a system issue. Your refund of RM[amount] is on hold. Confirm your bank details within 24 hours: [link]”

Red flag: a refund that needs you to “confirm” bank details or card numbers through a link, with a deadline. Refunds normally go back to the original payment method. You don’t type your card into a form to receive one.

What to do: Don’t tap. Open the official app or type the airline’s website yourself and check “My bookings”. If the flight shows as normal, the message is fake. Delete it and report the sender.

2. “Your Enrich points expire tonight.”

EXAMPLE (invented): “Hi [your name], 18,400 points on your member account expire at 23:59. Log in now to keep them: [link]”

Red flag: an urgent login link. The fake page copies the real sign-in screen and captures your password, and sometimes an OTP too. If you reuse that password, other accounts are at risk.

What to do: Check your points balance in the official app only. If you entered your password anywhere, change it from the real site and change it on any other account that uses the same password.

3. “Pay the rebooking fee to keep your seat.”

EXAMPLE (invented): “Your seat [real seat, e.g. 32K] on [real flight] will be released due to a schedule change. Pay a RM49 rebooking fee or upgrade here to keep it: [link]”

Red flag: a small, believable fee by SMS or WhatsApp, payable through a link or to a personal bank account or e-wallet. Small amounts lower your guard. The real aim is often your full card details and OTP.

What to do: Make any change inside the official app or website, never through a payment link in a chat. Never send money to a personal account. Check suspicious account or phone numbers on the police Semak Mule portal.

4. “Claim your compensation for the data breach.”

EXAMPLE (invented): “Following the recent data incident, affected passengers are entitled to RM300 compensation. Verify your identity with your IC photo and bank details: [link]”

Red flag: the breach itself becomes the bait. No airline has announced a compensation scheme for this incident in any statement we found. Requests for an IC photo or selfie hand scammers what they need to open accounts in your name.

What to do: Ignore it. Any real update will be on the airline’s official website or app. Our ID safety checklist explains when sending ID is never safe.

5. “We can recover your data or your money.”

EXAMPLE (invented): “Cyber Recovery Unit: your booking data was sold on the dark web. We can remove it and recover any losses. A one-time service fee applies. WhatsApp us: [number]”

Red flag: an upfront fee to “recover” money or “delete” data. Nobody can pull leaked data back off the internet. This is the classic recovery scam, and it often targets people who were already scammed once.

What to do: Never pay a recovery fee. Report real losses to the police and your bank (see the numbers below). Some “recovery agents” also ask you to install an app. That is the APK scam script, and it can empty your bank account.

Takeaway: All five end in the same place: a link, a payment, a code or your ID. Spot the request and you’ve spotted the scam.

What leaked vs what they will ask for

This table is the core of the problem. The left column is what a scammer may already know, based on the airline notices above. The right column is what they still need from you.

On codes, banks are blunt. RHB’s fraud page says: “Never reveal your OTP/TAC to any third party“, even if the caller claims to be from a bank or a government agency.

Takeaway: Booking data lets a scammer sound real. It does not let them pay with your money. They need you to hand over the right-hand column.

How to check any airline message in 60 seconds

1. Stop at the link. Don’t tap anything in the SMS, email or WhatsApp, including the “unsubscribe” or “call us” buttons.
2. Open the official app or type the website yourself. Use the app you already installed or a bookmarked address, not a search ad.
3. Check “My bookings”. A real cancellation, schedule change or refund will show there.
4. Look at the request, not the details. A link plus card, OTP/TAC, password, ID or payment means stop.
5. Call the number on the official website if you’re still unsure. Never call a number given in the message.
6. Report and delete. Block the sender and use the reporting routes below.

After an earlier Enrich data incident in 2021, the airline told members it would not phone them to update their information. That was a different incident, but the habit holds: you make the contact, through a channel you found yourself.

Want to test yourself? Try the HotStakes scam quiz.

Already tapped, replied or paid? Who to call

Speed matters. Banks can sometimes freeze a transfer if it is reported quickly.

1. Call your bank using the number on the back of your card. Ask them to block the card and flag any transfer.
2. Malaysia: call NSRC 997. The government portal lists the National Scam Response Centre hotline 997 as available daily, 24 hours. It advises calling within 24 hours of discovering the scam, contacting your bank, and lodging a police report.
3. Malaysia: check numbers and accounts on the police Semak Mule portal, run by the Commercial Crime Investigation Department (The Star).
4. Singapore: ScamShield Helpline 1799 (+65 6869 1799 from overseas), available 24/7 for scam enquiries. For urgent police help, call 999.
5. Hong Kong: Anti-Scam Helpline 18222, run around the clock by the police Anti-Deception Coordination Centre. It gives advice; report actual losses at a police station, or dial 999 in an emergency.
6. Change passwords for your airline account and anything that shares the password, and turn on extra login protection where it’s offered.
7. Watch your WhatsApp. If anyone asked for a 6-digit code, read the WhatsApp hijack scam script now.

More reporting routes by country are on our scam reporting page.

How we checked

FAQ

Was my credit card data stolen in the Malaysia Airlines data breach?

Malaysia Airlines says there is currently no evidence that customers’ financial information was accessed, and Amadeus says the same for payment data. Still watch your statements, and never re-enter card details from a link in a message.

How many Malaysia Airlines customers were affected?

The airline has not said. The figures in the news (about 92,000 for JAL, about 53,000 bookings for Cathay Pacific, about 37,800 for ANA) belong to those airlines, not Malaysia Airlines.

Which dates are affected?

Customer information processed through Amadeus between August 2023 and September 2026, according to the airline’s statement as reported by Malay Mail and The Vibes.

I got a Malaysia Airlines scam message with my real flight number. Is it real?

The real details don’t prove anything any more. Don’t tap the link. Open the official app or website yourself and check your booking. If it asks for card details, an OTP/TAC, a password, ID or a payment by chat, treat it as a scam.

Will Malaysia Airlines pay compensation for the breach?

No compensation scheme was mentioned in any statement we read on 2 Nov 2026. Treat any “claim your compensation” message as a scam unless the same offer appears on the airline’s official website.

Where do I report a scam in Malaysia?

If you lost money, call the NSRC hotline 997 (24 hours), call your bank, and lodge a police report. You can check suspicious phone numbers and bank accounts on the police Semak Mule portal.

HotStakes is an independent directory. Some links on this site are affiliate links; we may earn a commission at no cost to you, and it never changes our rankings. Gambling involves risk — only play with money you can afford to lose, and if it stops being fun, seek help. This article is general information, not legal advice. Read our full disclaimer.