Thursday, May 15, 2025
Caregivers need more support. We owe it to them.
Wednesday, May 14, 2025
Maybank CFO’s sacking — the allegations and rebuttals
This article first appeared in The Edge Malaysia Weekly on April 28, 2025 - May 4, 2025
ON Feb 17, Malayan Banking Bhd (KL:MAYBANK) announced to Bursa Malaysia a change in a principal officer — its chief financial officer (CFO) Khalijah Ismail had left the group “pursuant to an internal inquiry by the bank”.
Little else was divulged, but it was obviously not voluntary and was confirmed by Khalijah herself in a statement to The Edge: “I strongly disagree with the bank’s decision. No specific reasons were given for my termination, other than a claim that the bank had lost trust and confidence in me … I categorically deny any wrongdoing.”
The former CFO had been with the banking group for 33 years.
Maybank, in an online briefing with analysts on Feb 18, assuaged any concerns about the change, saying it was the result of non-compliance with internal requirements and processes.
No details on the alleged non-compliance was given but The Edge has sighted the show cause letter given to Khalijah and her response to it.
Maybank’s account of what happened
The show cause letter issued to Khalijah showed that her removal had to do with an attempt to scam the bank of US$985,426 (RM4.77 million). She was designated as the “incident owner”, that is, the person targeted by the scammers.
According to the allegations against her, Khalijah had on April 24, 2024, at 7.47am, received a message on her personal phone (as opposed to her work mobile phone) from a person claiming to be Alvin Lee Hang Eng, CEO of Maybank Singapore, using a Malaysian number (0176257610) that was not known to her. The person impersonating Lee requested her to make a payment on behalf of Maybank Singapore. At 12.53pm, Khalijah got a Zoom call from the impersonator, after which communication was via WhatsApp messaging.
According to the show cause letter, at 1.16pm, the Lee impersonator asked Khalijah via WhatsApp about Maybank’s bank balance, to which she responded that, “Maybank’s balance is in the billions!”
Subsequently, Khalijah received on her personal phone WhatsApp messages from a person claiming to be Maybank president and group CEO Datuk Khairussaleh Ramli using another number (01121137912) that was not known to her, supporting the Lee impersonator’s request for the transfer of US$985,426 to Zhuha Trading Ltd of Hong Kong via JP Morgan Chase Bank Bhd.
Although the transfer was made to JP Morgan, it was not immediately sent to the account of Zhuha Trading. The payment was held back for an extended period by JP Morgan. This was a red flag to Khalijah that something was amiss.
At 9.26pm, she called Lee on his official phone about the messages. He replied that he did not have her personal number to begin with, after which she informed him that someone was impersonating him.
Between 9.31pm and 9.33pm, Khalijah instructed the cancellation of the US$985,426 payment and for steps to be taken to have the funds returned. At 10.08pm, she was informed that JP Morgan had held back the payment, so the bank suffered no financial loss.
Eight months later, on Dec 10, 2024, Maybank’s group audit team conducted an interview with Khalijah on the transactions and events that took place on April 24 and an investigation interview was undertaken by executives with Maybank’s group industrial relations on Jan 13, 2025.
The executives questioned why Khalijah did not attempt to contact Lee or Khairussaleh on their phone numbers known or familiar to her to authenticate the request and subsequent instructions prior to her instructing the transfer of the US$985,426. She was also asked about the time gap between 7.47am and 9.39pm on April 24, from the time she received the Lee impersonator’s message to the time she recalled the payment of US$985,426.
She also allegedly “failed to properly report the external fraud/attempted scam to the appropriate parties in the bank and/or escalate the matter to Khairussaleh”. The show cause letter said, “It was noted that as of Jan 13, 2025, you still have not notified the president and group CEO [Khairussaleh] of the said incident.”
Khalijah was also questioned for not being suspicious, as Lee — who is based in Singapore — had used a Malaysian number not known to her to contact her. The question on Maybank’s bank balance should have also raised a red flag.
Maybank took issue that Khalijah only informed the head of the bank’s fraud unit, but did not follow up or validate the contents of a police report made to ensure its accuracy. She was also questioned about her emphasising in all her conversations with staff who were involved in the transfer that it was strictly private and confidential, and that no other employees be involved in the matter.
In total, there were seven allegations against Khalijah. They include her failure to call for confirmation and that she only reached out to the real Lee at 9.26pm, long after the transaction had been initiated.
Also, as the “incident owner”, Khalijah did not report the “near miss” or impersonation of Lee and Kharusalleh to her superiors or to Bank Negara Malaysia’s Operational Risk Reporting System, suggesting that she had ignored the significance and/or severity of the incident. She also did not lodge the police report herself despite a requirement that the “incident owner” must lodge a police report once a fraud is discovered, irrespective of the amount involved, as per Maybank’s procedures.
While a police report was lodged, it was done by a manager with the bank’s fraud management unit. However, the report was allegedly faulty as Khalijah’s communication with the head of the bank’s fraud unit had been inaccurate in that it was not made clear that the transaction had been authorised and routed for payment before being recalled and that it was only a “near miss” because JP Morgan had delayed approval which, in turn, led to her recalling the payment.
The show cause letter states: “Any one or all of the above stated allegations of misconduct levelled against you is/are serious in nature, and in doing so, you have breached your fiduciary duty as the group CFO, neglected to discharge your duties and obligations as the group CFO of the bank, knowingly and/or negligently breached the bank’s policies, failed to act in the best interest of the bank and/or failed to exercise due care and diligence as expected from you to safeguard the interest of the bank.”
Khalijah’s account of what happened
In her response to the allegations made in the show cause letter, Khalijah “categorically denies all allegations”.
She says she had acted decisively and swiftly to ensure that the bank’s interests were fully protected, and that the incident did not result in any financial loss to the bank. “The show cause letter presents a selective and incomplete account of the events surrounding the incident.”
Khalijah explains that maintaining multiple phones is common among senior officers. Thus, she believed that the Malaysian number used by the imposter was indeed Lee’s personal number. She says the imposter, in a text message, had sought her assistance on a confidential matter he was allegedly working on and inquired about her availability for a Zoom call.
Shortly after, she received a text message from another number which she believed to be the personal number of Maybank’s president and group CEO. But this was an imposter who mentioned that they (the people posing as Khairussaleh and Lee) were working on a confidential project, on which the details would be provided via the Zoom call.
Khalijah says she received another text message from yet another Malaysian number (01139560619), which she again believed to belong to Khairussaleh, using another line for the confidential project to be discussed.
The Zoom call, which commenced at 12.56pm, lasted for five minutes, after which the Lee impersonator sent a message saying the connection was bad and suggested that they continue via WhatsApp. The imposter then informed her that “we” — meaning he and Khairussaleh’s impersonator — were in the process of acquiring a new company to expand Maybank’s foreign operations and they had been working on a deal for several months, and any information leak could jeopardise the project, indicating the need for secrecy.
“He [the fake Lee] further stated that my assistance was required because the project required, what he stated at that time, to be completed with privacy, speed and efficiency,” Khalijah says in her reply. She adds that the Lee impersonator wanted to avoid any risk of insider trading, thus all communication would be limited to WhatsApp messages between her and him.
At 3.02pm, the Lee impersonator sent remittance details to her for the first deposit of the said merger, with payment of US$985,426 to Zhuha Trading in Hong Kong. Khalijah says she had queried him on the details, including whether the deposit payment needed to be made first before receiving further information, whether the payment needed to be made on the same day, and the nature of the merger, to which the imposter replied that he was not authorised to disclose additional information as yet.
At 3.09pm, she informed the person she thought to be Khairussaleh about this confidential transaction, that she had received instructions to make the deposit and shared details provided by the Lee impersonator. The person posing as Khairussaleh promptly confirmed the information and gave his approval.
Khalijah says, “I genuinely believed that the instructions originated from Lee and Khairussaleh.”
At 4.45pm, she received information that the payment of US$985,426 had been successfully routed to the agent bank, JP Morgan, for processing. At 6.28pm, she was informed that JP Morgan had put the payment on hold due to sanction screening.
Khalijah then attempted to call the Lee impersonator, but he did not answer. Instead, he sent a message saying he was in a meeting with the bank’s lawyers and reiterated that communication should be via WhatsApp messages.
An update to the Khairussaleh impersonator received the response and instruction to ensure that the payment goes through. He reiterated the need to communicate via WhatsApp to avoid insider information leaking out.
From 8.06pm to 9.15pm, Khalijah was in communication with a JP Morgan executive, and she grew suspicious when the screening took longer than expected.
She says in her reply to the show cause letter: “At approximately 9.27pm, it then occurred to me that the payment instructions might have been a fraudulent attempt by individuals impersonating Lee and Khairussaleh.”
She adds that she had attempted to call the JP Morgan executive but failed, after which she sent a message to hold the payment while she ascertained the legitimacy of the transaction.
Sometime between 8.59pm and 9.25pm, Khalijah finally contacted Lee using his work number, but he didn’t reply. At 9.32pm, she sent a WhatsApp message asking him if he had contacted her on her personal number. At 9.42pm, she informed him via WhatsApp that there could be someone impersonating him, after which Lee replied that he had not contacted her.
Khalijah says that at 10.11pm, she managed to confirm that the payment was on hold and at 10.15pm, she reported the incident to Maybank’s head of the fraud unit. The next day, April 25, 2024, she contacted the head of the fraud unit, and he confirmed that both a police report and a report to the Malaysian Communications and Multimedia Commission would be lodged in the afternoon.
Internal audit enquiries commenced in August 2024 and the findings were shared with Khalijah shortly after, in September and October 2024.
She says her meeting with the bank’s group audit team, which took place on Dec 10 last year, was a casual discussion rather than a formal interview and lasted only 40 minutes. At the meeting, she explained that she had expected the police report on the April 24 issue to be handled at the working level by the officers involved in executing the payment instructions.
She also said she wanted to inform Khairussaleh of the April 24, 2024, incident in January 2025 at a one-on-one performance appraisal with him. However, the session was rescheduled to Feb 5.
In summary, Khalijah’s main contention is that the bank suffered no financial loss. And she opines that her Zoom call with the Lee impersonator was equivalent to a call back. “I genuinely believed I was speaking to the real Alvin,” she says in her response to the show cause letter. “There was nothing unusual about the demeanour or body language of the imposter Lee.”
Khalijah, in response to other allegations, says she had adhered to the bank’s reporting guidelines on non-financial risk by immediately reporting the incident to the fraud unit, which is the first line of defence, and she had shared the relevant WhatsApp messages with the head of the fraud unit.
The head of the fraud unit, she says, was aware on the evening of April 24, 2024, that there were people impersonating Lee and Khairussaleh. He had other details of the attempted scam as well.
She also says, “I must state that in my experience as a senior management officer with the bank, I have never encountered a situation where a senior management officer was required to personally lodge a police report over a scam or attempted scam incident. Typically, the lodging of a police report on behalf of the bank is facilitated through the fraud unit or another unit responsible for handling fraud-related cases.”
The matter is now with the Industrial Court as Khalijah has filed a complaint of wrongful dismissal.
Save by subscribing to us for your print and/or digital copy.
P/S: The Edge is also available on Apple's App Store and Android's Google Play.
- US warns that using Huawei AI chip ‘anywhere’ breaks its rules
- Auditors flag going concern risk in Sapura Energy's FY2025 accounts; regularisation plan submission by month end
- MOF and three local banks to hold substantial stakes in Sapura Energy post-restructuring
- Zarul Ahmad: I kept a portion of RM79 mil obtained from Ewe in my office safe
- MN Holdings charts new record high as Maybank joins coverage with 'buy'
Level 3, Menara KLK, 1 Jalan PJU 7/6, Mutiara Damansara, 47810 Petaling Jaya, Selangor, Malaysia
Copyright © 1999-2025 The Edge Communications Sdn. Bhd. 199301012242 (266980-X). All rights reserved