Malaysia is turning its national digital identity scheme, MyDigital ID, into a default login layer for the mobile ecosystem, with regulators now requiring mobile network operators to integrate government-backed identity verification into their apps. According to the Mobile Ecosystem Forum, the government has mandated that every Malaysian telco embed MyDigital ID’s verification technology so that telco accounts and services are tied to a verified national identity rather than just a phone number. The policy is framed as a response to surging scam calls, which nearly doubled between 2023 and 2024, and to widespread misuse of prepaid SIMs for fraud.
The mandate builds on earlier announcements from the Communications Minister and the Malaysian Communications and Multimedia Commission, which set out a phased plan for implementation. From early November, operators began rolling out MyDigital ID verification in their apps, and by the beginning of December all major telco apps had started integrating the government digital ID. Local reporting indicates that existing subscribers can now see all prepaid numbers registered under their national identity card, MyKad, and confirm which ones are legitimate. New prepaid SIMs must be verified via the telco app using MyDigital ID, closing loopholes that previously allowed large numbers of SIMs to be registered to a single individual or under fabricated identities. At the same time, telco apps are beginning to offer MyDigital ID as a secure sign in method that can reduce reliance on passwords and SMS one-time codes, both of which are vulnerable to phishing and social engineering.
MyDigital ID itself is a government operated identity and signing platform that functions as a digital extension of MyKad. Citizens enrol through remote eKYC, capturing MyKad images and a facial scan, or in person at kiosks that perform card and fingerprint verification. The scheme is already integrated into several government apps and is expected to become a mandatory login method for services such as traffic enforcement and police payment applications. The telco requirement effectively extends that footprint into the private sector and positions MyDigital ID as a shared trust layer between government and communications providers.
For CISOs, the risk picture cuts both ways. Stronger binding between SIMs, telco accounts and a verified government identity should make it materially harder to operate scam call centres and to execute SIM based account takeovers at scale. At the same time, embedding a state issued digital ID into private telco apps concentrates sensitive identity data and authentication telemetry in a single scheme. That raises questions about how data minimisation will be enforced, how identity data may be re used across public and private services, and what security expectations will be placed on operators integrating the MyDigital ID software development kit. Much will depend on how regulators handle consent, revocation and auditability inside this new login pattern, and on whether alternative login options remain available. Those decisions will signal whether Malaysia is building a broadly trusted digital trust fabric or moving toward mandatory state identity for a growing range of commercial services.
Sources: Mobile Ecosystem Forum, SoyaCincau, Free Malaysia Today, Yahoo News Malaysia, MyDigital ID
—
By the ID Tech Editorial Team
