MyKad, or the Government Multipurpose Identity Card, was introduced in 2001 as one of the seven flagship applications under the Multimedia Super Corridor (MSC) initiative. Its goal was to modernise the national identity system, enhance identity security, and offer a digital platform that integrates multiple applications into a single card.
Commenting on MyKad’s evolution over more than two decades, National Registration Department (JPN) Director-General Badrul Hisham Alias said that four versions have been introduced, with the latest launched in 2012. However, the department is now in the final phase of developing a new MyKad version with enhanced security features.
“The first version used plastic before being upgraded to Polikad 2.0, followed by the current version, which includes additional features like a ‘ghost image’ to improve security.
“Overall, MyKad underwent major changes in 2012 to keep up with then-current technological developments, including design, security features and chip technology,” he said in an interview with Bernama.
Explaining the meaning behind the term ‘MyKad’, he said ‘My’ refers to Malaysia, while ‘Kad’ means identification card — its main function being to identify all Malaysian citizens.
“MyKad is the continuation of the country’s ID system, which started with paper cards (1948-1960), then blue plastic ID cards (1960-1990), followed by the hibiscus cards (high-quality IDs from 1990-2001), and now the modern MyKad,” he said.
Although not fully digital, MyKad is designed to support various government transactions and services by integrating digital applications like driving licences, international passport info, basic health data and e-wallets.
“MyKad is widely used in Malaysia’s public healthcare sector, especially for managing medical records, vaccinations, and access to public hospital services through identity verification.
“We’ve also collaborated with agencies like the Inland Revenue Board (LHDN) and Employees Provident Fund (EPF) to improve the effectiveness of financial aid delivery,” he said.
On public concerns about MyKad’s security, especially if it becomes more widely used for daily transactions, Badrul Hisham said the latest card version contains a chip with its own security features.
“It’s important to understand that this is not a security chip per se, but a chip with built-in security features. This chip can only be read, written, and recorded by the JPN’s approved systems. While the chip is also used in other industries, its usage in MyKad is tightly controlled,” he explained.
Visible security features include the ‘ghost image’ using laser engraving technology and enhanced smart chip capacity.
While chip card readers are widely available in the market, only JPN-approved devices can access MyKad data.
“Even if you go to a store using the same reader, the data cannot be accessed or altered, as only devices with JPN’s source code can do so,” he explained.
He said data sharing with other agencies like LHDN, the Road Transport Department (JPJ), police, Ministry of Health and others is conducted securely under a ‘Whole of Government’ approach.
Badrul Hisham noted that the MyKad chip is equipped with security keys to prevent unauthorised data access or misuse.
“MyKad data can only be accurately accessed using card readers programmed with specific MyKad command sets supplied by certified vendors and approved by JPN.
“Fingerprint data is encrypted and requires matching keys for access. Any information update can only be done at JPN counters through a card replacement process,” he explained.
Agencies such as the Immigration Department (JIM), banks, EPF and Tabung Haji can only read but not alter MyKad data.
He added that data sharing is regulated and must be approved by the JPN Director-General.
“This sharing is only allowed for specific purposes, like improving public services, policy development or research — all while ensuring data confidentiality and security,” he said.
Regarding the risk of MyKad forgery or data cloning, Badrul Hisham said the card is designed according to international standards (ISO/IEC 7810 and 7816) and is very difficult to forge.
“Security features exist on multiple layers of the card, with some requiring special tools for verification. This makes MyKad, especially the chip, very hard to counterfeit,” he said.
Currently, MyKad is used to distribute financial aid such as Sumbangan Tunai Rahmah (STR), SARA, and eKasih.
SARA, for example, involves 5.4 million recipients using aid from the Ministry of Finance to purchase items from 14 categories at participating outlets.
On the perception that SARA funds are “loaded” into MyKad, Badrul Hisham clarified that no money is credited to the card itself. Instead, recipients’ data is accessed through the store’s system during transactions.
“At participating stores, simply present your MyKad… once your ID number is entered, your name will appear, and you can shop based on your allocated aid amount,” he said, adding that the system also shows the remaining balance.
“For the RM100 SARA aid announced by Prime Minister Datuk Seri Anwar Ibrahim for all Malaysians aged 18 and above, recipients only need to present their MyKad to the cashier for identity verification,” he added.
He stressed that the redemption of the RM100 aid under the SARA programme cannot be delegated to another individual in accordance with the established regulations.
“It’s important to remember that MyKad cannot be held or used by others, including family members, in accordance with Regulation 25(1)(e) of the National Registration Regulations 1990,” he said.
Violators may face up to three years in prison, a fine of up to RM20,000, or both.
Ahead of the RM100 SARA disbursement on Aug 31, he advised MyKad holders to check their card chip and visit JPN for replacements if it is damaged.
Meanwhile, Badrul Hisham acknowledged that JPN’s initial goal to make MyKad a multi-purpose platform has yet to be fully realised, despite being in place for 24 years. Interest from government agencies in using MyKad as a core service delivery platform has also waned.
“Right now, it’s only used for basic ID verification — for instance, at hospitals for RM1 payments, or by agencies like the Department of Occupational Safety and Health (DOSH) and the Fisheries Department for fisherman fuel subsidies. TNG remains loyal as an e-wallet feature,” he said.
The latest MyKad version can support digital applications for payments, health records, and banking, thanks to its increased chip capacity — 124KB or 128KB compared to the previous 84KB.
“But many agencies have stopped using MyKad in their systems — like JPJ. Otherwise, we wouldn’t need to carry a physical driver’s licence; MyKad would suffice,” he said.
Commenting on MyDigital ID and MyKad, Badrul Hisham said the physical MyKad is governed by the National Registration Act 1959 and will remain relevant despite MyDigital ID implementation.
JPN is committed to ensuring MyKad remains a robust and relevant identity document, aligned with technological progress and public needs.
In the future, he said, MyKad will not only serve as a physical ID but also as a key to Malaysia’s digital ecosystem, integrating government, financial, healthcare and social services into one secure, efficient and accessible platform.
“Even in other countries with digital systems, physical ID cards still play a role.
“Our goal is to provide fully end-to-end services, including digital services,” he said.
To support this, JPN is in the process of amending the National Registration Act to enable digital applications via MyKad.
MYKAD REMAINS CRUCIAL IN TARGETED AID & SUBSIDIES
Meanwhile, Senior Lecturer at the Faculty of Economics and Muamalat, Universiti Sains Islam Malaysia, Dr Umi Hamidaton Mohd Soffian Lee, said MyKad is a personal information system for Malaysian citizens involving various government agencies, and therefore remains crucial in the distribution of aid and subsidies.
“MyKad serves as an integrated database, enabling the government to identify target groups (for the purpose of distributing aid and targeted subsidies) based on the profile contained in the MyKad, which includes information such as individual and household income, records of government aid received such as STR and SARA, individual status, as well as the number of dependents,” she said.
Citing the example of implementing targeted subsidies for petrol at petrol stations, she said using MyKad is more efficient as the card’s security features can prevent duplication.
“However, if the government intends to implement targeted petrol subsidies via MyKad scanning in the future, it is advisable to first enhance information and digital technology infrastructure in rural areas,” she said.
Umi Hamidaton also recommended that the quality of MyKad continue to be improved, noting that incidents still occur where the security chip cannot be read, and the card itself breaks easily.
“Overall, MyKad can serve as a method for implementing targeted assistance, but it needs to be strengthened to be more effective,” she said.
Blockchain technology could improve MyKad’s security and transparency by storing data in immutable digital ledgers, enabling full audit trails for each access, and using cryptography for secure identity verification.
Ts Dr Nor Alina Ismail, Head of the Faculty of Data Science and Computing at Universiti Malaysia Kelantan, told Bernama that blockchain can ensure better data integrity through permanent records, cryptography and transparent verification across networks — making manipulation or hacking very difficult.
“Unlike centralised systems that are vulnerable to breaches and data loss, blockchain offers distributed storage and real-time audit trails, ideal for sensitive data like health records and digital identity if combined with strong privacy protection mechanisms,” she explained.
She said MyKad could be enhanced into a digital identity wallet through blockchain, integrating personal data like e-wallets, digital certificates, driving licences, health records and ID data securely in a single chain of identity.
Using self-sovereign identity principles, blockchain could give users control over who accesses their personal data via decentralised verification, smart contracts and transparent access permission.
“For example, a user could allow a hospital to temporarily access only allergy history through a smart contract. All access is recorded on the blockchain, and users can see the full log in real time,” she said.
She added that zero-knowledge proofs can allow verification of status — such as citizenship or age — without disclosing the full data, improving privacy.
The technology also enables cross-sector use (government, banking, healthcare, education, transport) through shared ledgers and automated smart contract verification.
“For instance, when applying for a bank loan, the bank can verify ID through JPN and employment status via EPF or LHDN without needing physical documents.
“This access can also be restricted precisely via permissioned blockchain and logged for auditing, making processes more efficient and less prone to fraud while giving users full control,” she said.
Blockchain also offers additional security layers, such as digital signatures and blockchain-based multi-factor authentication, to ensure only legitimate users can access their identity.
Transparent audit trails also help detect and trace any attempt at fraud or breaches.
However, for full implementation, a legal framework, stable digital infrastructure and strong privacy protection are required.
Anticipating that MyKad will evolve into a fully digital identity system within 5-10 years, she said Malaysia could emulate countries like Estonia.
However, she acknowledged that building a blockchain-based MyKad system would require large government investment in technology, digital infrastructure upgrades, long-term maintenance, and training.
“The main challenge is the high initial cost due to upgrading current systems, bridging the digital divide, enhancing existing laws, drafting new ones, and developing a comprehensive cybersecurity policy,” she said.
“However, this transformation depends on the readiness of digital infrastructure, the legal framework, public technological literacy, and data security assurance. Therefore, in this decade, we may see a hybrid approach, where MyKad exists in both physical and digital forms before fully transitioning to a blockchain-based digital identity once the nation’s technological and legal ecosystem is truly ready,” she said.
