AI Weekly Malaysia

Grab has expanded its PayLater service to work with any physical merchant displaying a DuitNow QR code, letting users scan via the Grab app and split payments. The feature is currently rolling out to a limited group of users before potential wider availability.

Why: For Malaysian SaaS and commerce builders, this means Grab PayLater is now a viable BNPL payment option at virtually any offline DuitNow QR point-of-sale, not just Grab's own ecosystem. If you build POS, payments, or retail tooling, expect merchants and consumers to ask about DuitNow QR + PayLater integration and plan for how BNPL routing over national QR infrastructure affects settlement flows and fees.

Apple submitted a court-ordered proposal to charge 15% commissions on purchases made via external links inside iOS apps, with 5% for small business developers, 10% for certain partner programs, and 10% for subscription renewals. The Supreme Court rejected Apple's bid to delay, forcing the disclosure after Apple had previously imposed a 27% external-link commission that the court found problematic. Apple compared its rates to Google Play's 20% standard, 15% special program, and 10% subscription renewal link-out fees.

Why: If you ship an iOS app and route payments through external links, these proposed rates determine your unit economics: 5% if you qualify as a small business developer versus 15% standard. Founders should model both scenarios now and check whether their app qualifies for the small business or partner program tiers before finalizing pricing.

Grab PayLater can now be used at any physical merchant displaying a DuitNow QR code, not just Grab-specific QR standees. The feature is rolling out to a whitelisted group of users, who also earn up to 2x GrabCoins when paying via PayLater on a DuitNow QR code.

Why: If you build or sell into Malaysian retail payments, BNPL is now effectively universal at the point of sale via DuitNow QR—any merchant with the standard national QR code is a potential BNPL checkout. SaaS founders in POS, e-commerce, or fintech should evaluate whether their flows or merchant onboarding need to account for Grab PayLater as a payment rail alongside standard DuitNow QR processing.

Group-IB detailed a fraud campaign called WindRelay that combines a phone-based social engineering attack with two Android malware strains—SpyNote (a RAT leaked in 2016) and WindRelay (NFC relay malware discovered August 2025)—to clone contactless card transactions in as little as 13 minutes. The attacker poses as bank helpdesk, gets the victim to install SpyNote, which silently deploys WindRelay, then tricks the victim into tapping their card on their NFC phone and entering a PIN. WindRelay captures the live EMV APDU exchange and relays it to an attacker-controlled POS terminal or ATM, completing a genuine card-terminal handshake that authorizes fraudulent payments.

Why: If you build or operate payment, fintech, or banking apps in Malaysia—where contactless card and e-wallet usage is near-universal—this attack shows that contactless EMV is not a trust boundary you can rely on when the cardholder's own device is compromised. Fintech teams should evaluate whether their fraud detection can flag relay-style transactions characterized by unusual POS-to-cardholder geolocation or timing gaps, and whether customer-facing flows that instruct users to tap cards on phones create teachable moments for social engineering awareness.

Ryt Bank, backed by YTL Power International and Sea Limited, is the first Malaysian digital bank to allow account activation and initial funding via physical ATMs and bank branches through the Interbank GIRO (IBG) network. Users complete eKYC on the app, then fund at an ATM or over-the-counter; accounts activate within one working day, with no fixed minimum for offline transfers.

Why: For fintech and payments builders in Malaysia, this signals that digital banks are actively building hybrid onboarding flows that integrate legacy rails (IBG, ATM networks) rather than pure app-only journeys. If you're designing KYC or onboarding for underbanked segments, consider whether your flow assumes online banking access and whether partnering with physical cash-in channels materially widens your addressable user base.

JomCharge has activated a 200kW Kempower DC charger at McDonald's Yong Peng Drive-Thru, 3km from the Yong Peng North toll plaza, positioned as an off-highway option for Melaka-Johor EV travel. The charger costs RM1.40/kWh (RM0.70/kWh during a 50% launch promo from 14 Aug to 14 Sep 2026), with each of its two nozzles capped at 100kW. It supports activation via JomCharge, Gentari Go, ChargEV apps, and tap-to-pay with credit/debit cards.

Why: For builders in the Malaysian EV or payments space, the tap-to-pay card terminal and multi-app activation (JomCharge, Gentari Go, ChargEV) signal that interoperability and open payment rails are becoming standard expectations for local charging infrastructure. If you're building mobility, fleet, or payment apps, plan for card-based and cross-network access rather than assuming a single proprietary app gateway.

TNB Electron has activated a 120kW DC fast charger with two CCS2 nozzles at the McDonald's Drive Thru in Seri Austin, Johor Bahru, priced at RM1.50 per kWh. The charger supports tap-to-pay via credit or debit card at a JuiceUP terminal with no app required, and TNB Electron offered free charging for one day only on 15 August 2026.

Why: The tap-to-pay, no-app model is a notable UX shift for Malaysian EV charging infrastructure—if you build or invest in local payment or mobility services, this signals that charge point operators are moving away from mandatory proprietary apps toward open card terminals. For most builders in this audience, however, a single charger deployment has limited direct impact.

Google Play now supports Venmo as a payment method for U.S. users, allowing purchases of apps, games, subscriptions, and creator tips via Venmo wallet or linked bank accounts and cards. Google Play already supports PayPal, Cash App, and major card networks in the U.S., and has experimented with cash-at-store payments in other markets.

Why: Venmo is U.S.-only, so Malaysian developers targeting the U.S. market via Google Play now have another payment rail their users may prefer, but there is no direct impact on Malaysian domestic payments or local app monetization. The broader signal is that Google Play continues expanding alternative payment methods post-regulatory pressure, which may eventually influence what payment options roll out in Southeast Asia.

TNB Electron launched its largest EV charging site at Wisma TNB Seberang Jaya, Perai, with 480kW shared across 8 bays using a TELD DC Charger solution. Each nozzle is rated at 250A, capping 400V EVs at 100kW and 800V EVs at 200kW. Charging costs RM1.50/kWh via tap-to-pay at a JuiceUP terminal with no app required, with free charging offered on 15 August 2026.

Why: Minimal direct impact for this audience. The no-app, tap-to-pay payment flow via JuiceUP is the only mildly interesting infrastructure detail for anyone exploring card-based payments at unattended kiosks in Malaysia, but there is nothing here that requires a builder to change what they ship.