Short answer first: topping up Call of Duty Mobile CP for your Facebook-linked Garena ID in Malaysia is safe when you pay through the in-game store, the official Garena website, or a licensed Malaysian reseller like REDX Game, and the scam ecosystem documented by Malwarebytes in July 2026 does not touch the licensed route at all. It targets players who hand over their Garena password to a fake "free CP" site, which means that if you never give your password to a top-up vendor, your account cannot be hijacked through the top-up itself.
For Facebook-linked Garena IDs, REDX Game ships 80 CP to 10,800 CP with Player ID only, no password, through DuitNow QR or FPX, and delivery is advertised at 1 to 3 minutes, roughly the window a CODM match loads in. Senang gila untuk pemain Shah Alam yang nak Battle Pass sebelum match. Pros on the Malaysian CODM circuit, Geek Fam SG-MY and TODAK's squads among them, buy on the same rails because the match clock does not wait for the App Store.
Top up CODM CP without the phishing risk →
The six scam myths, dissected
Six beliefs keep showing up in Malaysian CODM Discord servers and in r/CallOfDutyMobile. Four are false, two are half-true. Here is each one against the record.
Myth 1: "Any third-party top-up is a ban risk"
Reseller top-ups through official partner APIs are not a ban risk, because Garena issues bans for mod menus, aim assists and third-party clients, not for a CP transaction that moves through its own backend. The ban-risk accusation applies to key-selling grey-market sites, which is a different product entirely. REDX Game sends the CP through the official Garena top-up endpoint; the credit lands as if you bought it in the store.
Myth 2: "You have to give your password to top up CP"
No legitimate reseller asks for a Garena password; a licensed Malaysian reseller only ever takes a Player ID, and if a site asks for your password, that is the July 2026 phishing wave Malwarebytes documented, where a fake CODM site promised a reward "confirmed in four to eight hours" to buy time while the attackers drained the account. The password request is the tell. Walk away.
Myth 3: "The App Store price is always safer than a reseller"
Safer, maybe. Cheaper, no, because Apple takes a 30% platform cut and converts USD at an unfriendly rate for Malaysian cards, and the arithmetic is unforgiving: RM 29.90 on the App Store buys 400 CP, RM 25.00 at REDX Game buys the same 400 CP. Berbanding App Store, that is RM 4.90 saved on the smallest premium tier, and the gap scales so that at 2,000 CP the difference lands around RM 25. Pandang balik dalam setahun, that is three or four Battle Passes free. "Safer" has a price, and it is not zero.
Myth 4: "DuitNow QR means my bank data is exposed to the reseller"
DuitNow QR is a Bank Negara-regulated rail, so the merchant sees a payment confirmation, a reference number and the amount, nothing else, and it does not see your bank login, your card number, or your balance at any point in the flow. Bayar guna DuitNow QR, and the only data that moves is the ringgit figure. Same for FPX, TNG eWallet, and Boost.
Myth 5: "Facebook-linked accounts in Malaysia are about to be banned"
Half-true, and worth reading carefully. A Garena notice dated 15 June 2026 for a different title, Delta Force, told Malaysian players that accounts linked only to Facebook may lose access under new local social media rules, and while the same company has not published the equivalent notice for CODM yet, the sensible response is to bind a second login method (usually Google or an email account) as a backup inside the Garena app. Your CP top-ups still work on the Facebook-linked ID either way, and the risk is losing Facebook login rather than losing the game itself.
Myth 6: "Instant delivery means it is a scam"
Backwards. Instant delivery is the mark of a direct API integration, while scams run on delay: the "confirmed in four to eight hours" promise Help Net Security quoted is the giveaway, because the attacker needs that window to log in, change the password, and empty the inventory. A real top-up credits in 1 to 3 minutes.
Our one-pass safety test
Before you click any top-up link, run these five checks, which we built from the pattern Help Net Security reported in July 2026, and treat any single failure as reason to close the tab immediately.
- Does it ask for your password? If yes, leave. Player ID only.
- Is the domain the one you expected? redxgame.com, not redxgame.co or redxgame-cp.net; scam domains squat one letter off.
- Does the price make sense? 10,800 CP at RM 30 is a trap, and if the quote is less than half of a licensed Malaysian reseller's figure, it does not exist.
- Does it quote MYR? A page that quotes USD or converts your currency on the fly is routing through somewhere it should not be.
- Does it deliver in minutes, not hours? Four to eight hours is the scammer's workday; real top-ups arrive before your match loads.
Where the real risk actually lives
The CP transaction itself is boring, and the real risk lives in three places most Malaysian players underestimate: password reuse, SMS-only 2FA, and forgotten Facebook sessions on shared machines.
If your Garena password is the same as your Facebook password, a Facebook breach gives the attacker your CODM inventory too, so change one, change both; Garena's account page lets you reset in under a minute. Boleh tahan kalau rajin check sekali seminggu.
Malaysian players who still rely on SIM-based 2FA are exposed to SIM-swap attacks that have become common in KL and Johor Bahru in 2026, so switch to Google Authenticator inside the Garena app settings because it works offline, survives a lost phone, and does not depend on your telco. If you ever logged into Facebook on a mamak PC in Petaling Jaya, log it out remotely from your phone's active-sessions list before you go to bed, since a forgotten session on a stranger's browser is a free gift to whoever sits down next.
The ringgit math behind the "safer" claim
Two tiers most Malaysian players buy, with the current numbers. Prices are what you see at checkout, not advertised rates.
- 400 CP: REDX Game RM 25.00. Apple App Store RM 29.90. Gap: RM 4.90.
- 2,000 CP + bonus: REDX Game around RM 109. Apple App Store around RM 134. Gap: around RM 25.
Battle Pass sits at 220 CP, so the 400 CP pack covers it with 180 CP left for a crate pull, while Battle Pass Bundle at 520 CP fits inside the 800 CP pack with change to spare. Buy the pack that covers your plan plus one small pull, because the per-CP cost at 400 CP is sharper than at 80 CP and the drop-off above 2,000 CP is modest. Murah giler for Johor Bahru and Penang players bayar guna TNG eWallet, which also waives any FPX bank fee that FPX normally tacks on at a rural branch.
Frequently asked questions
Is a Malaysian reseller different from the official Garena top-up?
A licensed Malaysian reseller routes CP through Garena's authorised top-up endpoint, so your purchase appears to Garena as a direct top-up on your Player ID, the CP lands in the same wallet the in-game store writes to, and it is not a grey-market key seller in any sense.
Will topping up through REDX Game get my Facebook-linked Garena account banned?
No. Bans are issued for cheating software (mod menus, aimbots, scripts) and for account sharing that violates Garena's TOS, which means a CP purchase through a licensed Malaysian reseller is a transaction, not a TOS violation, and in four years of operation we have not seen a ban triggered by a licensed CP top-up.
Do I need my Garena password to top up?
No. Player ID only. A licensed reseller will never ask for your Garena password, your Facebook password, or any OTP you did not initiate, so if anyone asks for a password, treat it as a phishing attempt and leave.
What payment methods are safest in Malaysia for CODM CP?
DuitNow QR and FPX are both Bank Negara-regulated rails and are the safest, while TNG eWallet and Boost are also fine, all four work at the REDX Game checkout, and the rule is to avoid any site that requires a direct credit-card entry outside of 3-D Secure.
What should I do if I already entered my password on a "free CP" site?
Change your Garena password immediately, change your Facebook password if the account is Facebook-linked, switch 2FA to Google Authenticator rather than SMS, review your Garena active sessions and sign out anything you do not recognise, then report the phishing URL to Garena support.
Bottom line, in one line
Pay through the in-game store, through the official Garena website, or through a licensed Malaysian reseller like the CODM Facebook-linked top-up page; refuse any site that asks for your password; delivery arrives in 1 to 3 minutes on DuitNow QR, FPX, TNG eWallet or Boost.