Since January 1, 2024, every visitor entering Malaysia must submit the Malaysia Digital Arrival Card (MDAC) within 72 hours before arrival. The form is completely free. The whole process takes about three minutes. And if you don’t have the QR code it generates, the airline won’t issue your boarding pass.

Malaysia doesn’t require a visa for Americans. Ninety days, no application, no fee, no pre-approval waiting period — show up with a valid passport and immigration waves you through on a social visit pass. That’s the entry system most travelers know.

Malaysia’s Immigration Department — cited in BERNAMA warnings published across 2025 and into 2026 — has been explicit about what’s happening in parallel: fake MDAC sites have proliferated, charging between USD $10 and $80 for a process that costs nothing. One case documented by Soya Cincau involved a tourist who paid RM145 (~$33 USD) to a fake portal that did nothing more than run the same free government form for a fee. The American travel press has barely covered this. The scam sites have no trouble finding Google visibility.

Quick Facts — Malaysia MDAC 2026

Detail	Info
Mandatory since	January 1, 2024 (launched December 1, 2023)
Who needs it	All foreign nationals entering Malaysia
Americans	Visa-free for 90 days, but MDAC still required
Submission window	Within 72 hours before scheduled arrival only
Submit too early	System rejects it
Cost	Free
What it generates	QR code checked by airlines at check-in
Official portal	imigresen-online.imi.gov.my/mdac/main (.gov.my domain only)
Scam site pricing	USD $10–$80 for a free government form
Does this replace a visa?	No — Americans don’t need a visa; MDAC is separate
US Embassy guidance	my.usembassy.gov (changes to arrival procedures)

In one sentence: Malaysia’s MDAC is a free, three-minute digital form required within 72 hours before arrival — submit it only at the .gov.my official portal, because scam sites charging up to $80 for the same form have prompted repeated official government warnings.

What Is the MDAC?

The Malaysia Digital Arrival Card replaced the paper arrival card that used to be handed out on planes and collected at immigration. Same information, different delivery. You fill it out online rather than on the plane with a borrowed pen and a wobbly tray table.

The form is run by Malaysia’s Immigration Department (Jabatan Imigresen Malaysia) through its portal at imigresen-online.imi.gov.my/mdac/main. You enter your passport details, travel information, and your intended address in Malaysia. The portal generates a QR code. Airlines scan that QR code at check-in. That’s the complete chain.

The MDAC is not a visa. Americans visiting Malaysia for up to 90 days don’t need a visa at all, per US State Department guidance — Malaysia grants American passport holders a social visit pass on arrival. The MDAC doesn’t change that. It’s a pre-arrival data submission layered on top of existing entry rules, not a replacement for them.

What Malaysia wants is to know you’re coming before you board, not after you land. The information was always collected at immigration. The MDAC moves that collection point to the check-in desk at your home airport.

The 72-Hour Window Goes Both Ways

Most posts about the MDAC mention the 72-hour requirement. Fewer mention what happens at the other end.

Submit too late (within the final hours before your flight with check-in already closed) and you’re scrambling at the counter. Submit too early — more than 72 hours before your scheduled arrival in Malaysia — and the system rejects the submission outright. The portal is designed to accept registrations only within that specific window.

The practical approach: fill it out the evening before your departure, after online check-in opens and your confirmed flight number is in hand. If you have a connecting itinerary, the 72-hour window is measured against your scheduled arrival time in Malaysia — not your departure from home. A long routing with an overnight layover in another country is still fine. Submit against the Malaysia landing time, not when you leave.

If your Malaysia arrival changes after you’ve submitted — a flight reschedule, missed connection, new routing — submit a fresh MDAC with the updated details. The QR code from the original submission reflects the old flight information and may not clear the airline’s system if the times don’t align.

Why Airlines Are Checking This

Carriers don’t enforce the MDAC out of goodwill. The mechanism is carrier liability: airlines that board passengers without a valid MDAC registration risk penalties from Malaysian immigration authorities. The same model that makes the UK ETA and Australia’s ETA non-negotiable applies here — the airline becomes the first compliance checkpoint because they’re the ones facing consequences for missing it.

The result is that QR code verification happens at check-in, not at boarding and not at immigration. No valid MDAC submission in the system, no boarding pass issued. Getting the MDAC done after the check-in desk closes isn’t an option.

The US Embassy in Malaysia has issued specific guidance on this, framing it plainly: travelers who fail to complete the MDAC may be denied boarding.

The pattern is identical to India’s e-Arrival Card — a free, mandatory pre-arrival registration that most American travelers booking from pre-2024 guides didn’t know existed until they hit the check-in counter. The MDAC has been on the books since December 2023. The scam ecosystem building around it is a 2025 and 2026 development.

How Do I Apply for the MDAC?

The complete official process at imigresen-online.imi.gov.my/mdac/main takes about three minutes:

1. Go to imigresen-online.imi.gov.my/mdac/main. Confirm the URL ends in .gov.my before entering anything. That is Malaysia’s official government domain extension — the equivalent of .gov in the US. Any other domain is not the Malaysian government.
2. Enter your passport details — full name exactly as it appears on your passport, passport number, nationality, date of birth, and expiry date.
3. Enter your travel details — airline, flight number, scheduled arrival date and time, port of entry (typically Kuala Lumpur International Airport or Penang International for most American itineraries).
4. Enter your accommodation in Malaysia — hotel name and city. First night’s hotel is sufficient.
5. Select your visa status. For Americans: visa exemption. You don’t have a visa number because you don’t need a visa.
6. Submit. No payment screen will appear. No fee of any kind. If a payment screen appears, you’re on a fake site — close the tab immediately.
7. Save the QR code — displayed on-screen and sent to your email. Screenshot it. Have it accessible offline on your phone before the flight.

That’s the complete process. No documents to upload. No biometrics. No waiting period — the QR code is generated immediately on submission.

The Scam Problem Is Real and Active

Malaysia’s Immigration Department has been issuing public warnings about fake MDAC sites since the requirement launched, and those warnings have continued into 2026 because the sites haven’t stopped.

The playbook is consistent: a site designed to look like an official government portal, a form that mirrors the real one, and a payment step inserted before submission. Sometimes the fake site delivers a QR code that doesn’t clear the airline’s system. Sometimes nothing comes at all. In the worst cases, it just takes your credit card details and goes quiet. What it never does is charge less than zero, which is what the real portal costs.

Malay Mail reported the Immigration Department’s explicit warning to tourists to use only official government channels. BERNAMA named specific fake domains — including sites like mcadfast.com — as fraudulent operations requesting credit card numbers through fake processing fees.

The fake sites reach you through search ads and SEO. Type “apply MDAC Malaysia” without landing on the official portal and the results include things that look authoritative, have plausible-sounding domain names, and are asking for money. This is the same pattern that runs around every government travel fee that can be applied for directly but looks complicated enough for intermediaries to insert a fake transaction layer.

The tell is simple: .gov.my is Malaysia’s official government domain. The MDAC portal is at imigresen-online.imi.gov.my. Any URL that doesn’t end in .gov.my is not the Malaysian government. The scam sites range from $10 on the cheap end to $80 on the high end. The RM145 (~$33 USD) case is one of the documented mid-range examples. The $80 figure appears on higher-priced “full service” portals explicitly targeting travelers who assume a more polished interface means a more legitimate site.

Who Has to Submit

All foreign nationals entering Malaysia must submit the MDAC, regardless of nationality, visa type, or length of stay.

For Americans specifically: you’re exempt from needing a visa (90-day social visit pass granted on arrival), but that visa exemption doesn’t exempt you from the MDAC. The two requirements are separate. “I don’t need a visa” reasonably sounds like “I don’t need to do anything before I arrive” — that was true before December 2023. It isn’t true now.

There are no published age-based exemptions in the current requirements. If you’re traveling with children, each person with a foreign passport submits their own MDAC entry.

Malaysia in the 2026 Pre-Arrival Picture

Malaysia isn’t an outlier. The consistent direction in 2026 has been toward mandatory pre-departure digital registration, with airlines handling the first compliance checkpoint before passengers ever reach a border.

The UK ETA costs £20 and runs on the same carrier-enforcement model. New Zealand’s NZeTA totals NZD $117–123. ETIAS for Europe is €20, scheduled for later in 2026. Australia, Canada, and the US all have equivalent systems.

What stands out about Malaysia’s version: it’s free. No government fee to collect. The form exists purely for pre-arrival data — Malaysia wants to know who’s boarding before they land, and that’s the entire purpose. In a year where seemingly every major destination has introduced or raised a new arrival fee, the MDAC is the rare requirement with a $0 price tag attached.

Which makes the scam ecosystem particularly direct in its exploitation. The government charges nothing. The fake sites charge up to $80. The entire spread between those numbers is manufactured.

Malaysia Is Worth Every Minute of the Prep

None of this changes what Malaysia actually is. Kuala Lumpur’s skyline as seen from the Petronas Towers observation deck — one of the better city views in Asia. Penang’s Georgetown neighborhood, a UNESCO World Heritage Site with some of the most interesting street food in Southeast Asia. The rainforests of Borneo, among the oldest on the planet, with the wildlife that comes with them. Langkawi’s beaches. Melaka’s Dutch colonial quarter. The Cameron Highlands if you want something cooler and green.

The MDAC is three minutes and costs nothing. One checkbox in an itinerary that probably took weeks to build.

The travelers it catches are the ones who’ve done everything right — booked flights, sorted accommodation, confirmed no visa is needed, packed — and then hit a check-in agent who needs the QR code. The information gap is the only problem. It’s completely closeable with three minutes on the right URL.

The Bottom Line

Malaysia’s MDAC has been mandatory for all foreign nationals since January 1, 2024 — free, required within 72 hours before arrival, and checked by airlines before your boarding pass is issued. Americans are visa-free for 90 days, but the MDAC still applies. Visa exemption and pre-arrival registration are separate requirements.

Submit at imigresen-online.imi.gov.my/mdac/main. That URL ends in .gov.my. Anything else is not the Malaysian government. No payment screen should appear — if one does, close the tab.

Do it the evening before your flight, within the 72-hour window, after you have a confirmed flight number. Three minutes. One QR code. Screenshot it, have it offline, hand it to the check-in agent if they ask. Done.

---

MDAC official portal: imigresen-online.imi.gov.my/mdac/main. US Embassy guidance: my.usembassy.gov. BERNAMA scam warning: bernama.com. Malay Mail Immigration Department warning: malaymail.com. Information current as of May 2026 — verify requirements with Malaysia’s Immigration Department before travel.