Each of these is a refusal this regime lets a counterparty attempt, paired with the answer to it. Reading them before you write is worth more than any amount of polish on the letter itself.
"The merchant is abroad, so there is nothing we can do"
high likelihoodThe institution treats a cross-border transaction as outside its reach and refers you to the merchant's own country.
What answers it
Your counterparty is the institution that debited your account, and it is regulated where you are. The card schemes operate cross-border disputes as a matter of routine — that is most of what the scheme rules are for. Ask the institution to state, in writing, which rule it says prevents it from raising a cross-border dispute.
"The transaction was authenticated with your OTP/PIN, so you authorised it"
high likelihoodThe institution treats a one-time password or a PIN entry as conclusive proof that the cardholder consented.
What answers it
Authentication proves that a credential was used, not that you consented to that particular payment. Ask for the authentication log, the device and channel used, and the merchant identifier. Where the credential was obtained by deception, or where the institution ignored its own fraud-monitoring signals, the analysis changes — and in several regimes here the burden of proving authorisation sits on the institution, not on you.
Financial Services Act 2013 (Act 758), Schedule 7 — prohibited business conduct by a financial service provider, and Bank Negara Malaysia's power to make conduct standards
Silence, indefinitely
high likelihoodThe complaint is acknowledged and then simply never answered, which in practice defeats more claims in this region than any substantive argument.
What answers it
Treat silence as a refusal and escalate on that basis. Write once more, state the date of your complaint and the reference, say that you are treating the absence of a decision as a refusal, and copy the regulator or redress body named in this result. A file that has gone to the regulator gets answered.