How to Watermark Your MyKad Copy Before You Submit It

It happens at a counter, in a WhatsApp thread, or on a form: "Boleh bagi salinan IC?" You snap a photo of your MyKad, send it, and the process moves on. Nobody signs anything, nobody logs anything, and you have no idea where that image ends up.

Malaysians hand over MyKad copies constantly — to banks, telcos, landlords, employers, condo management, car rental counters, even to book a badminton court. Each copy is a small, permanent transfer of your identity into someone else's systems. This guide covers what a MyKad copy actually gives away, what to write on the watermark, which fields you can mask, and how to do all of it in about a minute without the image ever leaving your phone.

What a MyKad copy actually reveals

More than most people realise, because the NRIC number is not a random serial. It is structured, and the structure is public knowledge.

A MyKad number looks like YYMMDD-PB-###G, and each block means something:

• The first six digits are your date of birth (YYMMDD). Not encoded, not hashed — just printed.
• The next two digits are a place-of-birth code, identifying the state you were born in, or a code range for people born outside Malaysia.
• The last digit indicates gender — odd for male, even for female.

This matters for a practical reason. People sometimes mask the last four digits of their NRIC and consider the copy protected. It is not: your date of birth, birth state and gender are still sitting in plain sight in the part they left visible. Combine that with the full name, address and photograph printed on the card, and a single photocopy is a complete identity package — enough to open things in your name, and enough to answer the security questions that guard the things already in your name.

What actually goes wrong in Malaysia

These are not hypotheticals. They are the patterns Malaysian consumers and banks deal with routinely.

• Loans and credit taken in your name. A syndicate with a clean IC copy can apply for financing with licensed and unlicensed lenders. The first you hear of it is a collection call, or a rejected loan application of your own years later.
• Mule accounts (akaun keldai). Your identity documents get used to open or register accounts that scam proceeds pass through. When the account is flagged, the name attached to it is yours — and unwinding that involves police reports and frozen accounts, not a phone call.
• SIM cards registered to you. Prepaid SIM registration is mandatory in Malaysia, which makes a registered number valuable to scammers precisely because it looks legitimate. A SIM registered against your IC and later used for fraud puts your name on the trail.
• Ah Long harassment. Illegal moneylenders work from documents. An IC copy that leaks into that world can attach your name and address to a debt you never took.
• Recruitment scams. "Send your IC copy to confirm your interview slot" is one of the most effective collection methods in existence, because it arrives wrapped in the hope of a job.

The common thread: none of these need your physical card. They need a clean, unmarked image that looks like it was produced for whatever purpose the fraudster claims. That is the specific thing a watermark takes away.

Where the PDPA fits

Malaysia's Personal Data Protection Act 2010 gives you more standing than most people use. Under the General Principle, an organisation should collect personal data for a lawful purpose directly related to its activity, and only to the extent necessary — data collected should be adequate but not excessive. You are also entitled to be told the purpose of collection and who the data may be disclosed to, and you have rights of access and correction. Amendments that took effect in 2025 strengthened the regime further, adding obligations such as breach notification and the appointment of data protection officers.

You do not need to cite chapter and verse at a counter. Two questions do the work: "What is the copy used for, and how long is it kept?" A legitimate organisation answers easily. Hesitation is information.

Worth knowing: the PDPA governs commercial transactions, so its protections are aimed at businesses rather than every situation you might encounter. Treat it as a strong basis for asking questions, not as a guarantee that a copy will be handled well.

What to write on the watermark

Three elements, every time: the recipient, the purpose, and the date.

• Weak: "COPY" or "SALINAN SAHAJA". True of every photocopy ever made. It names nobody, limits nothing and never expires.
• Weak: "CONFIDENTIAL". Better tone, same gap — no recipient, no purpose, no date.
• Strong: "For Maybank account opening only — 17 Aug 2026". One organisation, one process, one moment.

Each part earns its place. The recipient makes the copy visibly out of place anywhere else, and tells you which submission leaked if it resurfaces. The purpose narrows it from "proof of identity" to one specific transaction. The date ages it — a three-year-old stamp invites the question a clean scan never prompts.

Write the organisation's real name rather than an abbreviation, and add the branch when you know it. "For CIMB Bandar Utama branch account opening only" is meaningfully harder to reuse than "For bank".

How to watermark your MyKad copy

The safe way to protect an identity document online is to never put it online in the first place. ImageMarker runs entirely inside your browser — the image is processed on your own device and is never sent to a server. For a document like this, that property matters more than any feature.

1. Open imagemarker.app/en/ on your phone or laptop. No install, no account.
2. Add the photo or scan of your MyKad. It stays on your device the whole time.
3. Type your recipient, purpose and date, for example "For Maybank account opening only — 17 Aug 2026".
4. Turn on tiled / repeat mode. A single mark in one corner is one crop away from gone. Tiled coverage cannot be removed without visibly wrecking the image.
5. Set opacity to about 40–60%. Clearly legible, but light enough that the name, NRIC and photo underneath stay readable.
6. Check before you send. Zoom in. If the officer cannot read a field they need, you will be asked to redo it and the whole exercise costs you time instead of saving it.
7. Send the marked copy only, then delete the clean original from your gallery and downloads so it cannot be forwarded by accident later.

One quick test for any online tool you use for this: turn on flight mode first. If it still works offline, the processing is genuinely happening on your device. If it stalls, your IC was going to be uploaded.

Scenario by scenario

Opening a bank account

This is the case where a full copy is genuinely required. Banks operate under Bank Negara Malaysia's anti-money-laundering rules and must perform customer due diligence, which includes identifying you from an official document and retaining records for a period set by regulation. Masking the NRIC number here will get the application bounced.

So watermark rather than mask: "For [Bank] [branch] account opening only — [date]". Keep opacity on the lighter side so the scanning officer has no trouble. This is also the scenario where a leaked copy is most valuable to a fraudster, which is exactly why binding it to one bank and one date is worth the minute.

Telco and SIM registration

Prepaid SIM registration requires verified identity, so a copy or a sighting is expected. What is often not needed is a copy retained by a small reseller kiosk. Where you can, register at an official service centre rather than leaving an IC image on a shop owner's phone.

Watermark it as "For [telco] SIM registration only — [date]". If the copy ever surfaces attached to a different telco or a loan application, the mismatch is obvious on its face.

Renting a room or a unit

At the viewing stage, you generally do not need to hand over anything. Offer to show the original for sighting. An agent or owner who insists on keeping a copy before any agreement exists is collecting more than the situation requires.

At the tenancy agreement stage it is reasonable. Watermark with the landlord or agency name, "tenancy agreement only", and the date. If the unit address is on the agreement anyway, there is no reason for the copy to travel further than that. For the wider picture on rental paperwork, see protecting your ID documents when renting.

Job applications and onboarding

Timing is the whole signal here. At onboarding, after you have accepted an offer, an employer legitimately needs your IC for EPF, SOCSO and tax registration. That is normal.

At the application stage it is not. A request for an IC copy before any interview, from a company you have not verified, on a chat app, is the single most common shape of recruitment fraud in the region. Watermark whatever you do send with the company name and "employment onboarding only" — and treat the timing of the request as the more important signal.

Beyond the watermark

• Mask fields the recipient does not need. Use a mosaic or solid block over the address or the NRIC when the purpose does not require them. Faint blurring is not enough for digits — cover them properly.
• Strip the EXIF data. A phone photo of your IC usually carries GPS coordinates, which for most people means their home address. Your MyKad already prints your address; the photo adds precise coordinates and a timestamp on top. Remove them with the EXIF cleaner.
• Send the front only, unless asked otherwise. Fewer fields in circulation, less to lose.
• Be careful with WhatsApp. Once an image is in a chat it is in two galleries, gets auto-saved, and gets backed up to two cloud accounts. Prefer an official upload portal where one exists.
• Check your own credit records periodically. CCRIS and the private credit bureaus will show financing taken out in your name. Catching it early is the difference between a dispute and a debt.

FAQ

Q: Is it legal to watermark my own MyKad copy in Malaysia?
A: Adding a semi-transparent purpose note across a photocopy of your own MyKad is a labelling step, not an alteration — the details stay readable and your physical card is untouched. What is prohibited is defacing or tampering with the MyKad itself, which is a different act entirely. Keep the watermark light enough that your name, NRIC number and photo remain legible.

Q: Can a landlord or agent demand a copy of my MyKad?
A: They can ask, and at the tenancy agreement stage it is normal. But under the PDPA 2010, personal data should be collected for a lawful purpose directly related to the organisation's activity and should not be excessive for that purpose. Asking what the copy is for and how long it will be kept — or offering to show the original for sighting during a viewing — is entirely reasonable.

Q: Should I black out my NRIC number on the copy?
A: Only if the recipient does not actually need it. A bank performing customer due diligence does. A landlord at a viewing usually does not. Remember that the first six digits are your date of birth and the next two a place-of-birth code, so masking only the last four digits leaves most of it exposed.

Q: What should the watermark actually say?
A: The recipient, the purpose and the date — for example "For Celcom SIM registration only — 17 Aug 2026". A generic "COPY" or "SALINAN SAHAJA" names nobody and limits nothing.

Q: Does ImageMarker upload my MyKad to a server?
A: No. Everything runs inside your browser, so the image never leaves your device and there is nothing on our side to store or leak. Switch on flight mode and the tool still works — which is the simplest way to prove it to yourself.

One minute, before you hit send

You cannot avoid handing over MyKad copies in Malaysia. What you can decide is what is written on them when they go. Send only what is asked for, mask what is not needed, write the recipient, purpose and date across the whole image, and strip the metadata. That is the difference between a copy that works anywhere and a copy that works in exactly one place.