LoginJoin Now

Security

M2 Password Safety

Your username, password and OTP are the only keys to your M2 account and balance. Treat them like your bank PIN.

Build a strong password

  • Make it long: 10+ characters. A phrase like Teh-Tarik-Kurang-Manis-27 is strong and easy to remember.
  • Make it unique: never reuse your email, banking or Facebook password.
  • Avoid personal info: no IC number, birthday, phone number or your username.

Your OTP is for your eyes only

M2 sends a one-time code by SMS or email when you register or recover your account. Type it into M2's own form on the official link and nowhere else. No genuine M2 staff member will ask you to read out or forward an OTP.

Remember Me: when to use it

DeviceRemember Me?
Your own phone with a screen lockOK
Family or shared phoneNo
Office or cyber café computerNo, and log out when done

Signs someone else has your password

  • Your balance or history shows activity you did not make.
  • You receive an OTP you did not request.
  • Your password suddenly stops working.

If you notice any of these, reset your password with Forgot Username/Password and contact M2 support through LiveChat on the official site.

Sharing an account is risky in more ways than one. Besides the security risk, M2 prohibits irregular activity and multiple account abuse, which can lead to an account review.

FAQs

Questions

What makes a good M2 password?

At least 10 characters, a mix of words, numbers and symbols, and not used on any other site. A short phrase you can remember works well.

Should I save my M2 password in my browser?

On your own locked phone, a password manager or the browser's saved passwords is safer than reusing a simple password. Never save it on a shared device.

How often should I change my password?

Change it straight away if you shared it, typed it on a suspicious site, or logged in on someone else's phone. Otherwise a strong, unique password does not need frequent changes.

Should I share my M2 account with a friend?

No. Sharing puts your balance at risk, and M2 prohibits irregular activity and multiple account abuse.

What should I do if I get an OTP I did not request?

Someone may be trying to get into your account. Do not share the code, change your password with Forgot Username/Password, and contact M2 support through LiveChat.