TACs are usually sent when you make payment involving online banking transactions. The code, usually consisting of six numbers, will be sent to you, so that you can input them as a form of confirmation and authorisation of your payment.
That said, when scammers make transactions using your stolen details, you will still be sent the TAC. If they’re bold enough, the scammers will call you, asking you to read the TAC out to them. Doing so then allows them to make purchases while you unwittingly foot the bill. The Star quoted CCID Deputy Director of Comms Datuk Saiful Azly Kamaruddin as saying that this January alone saw 33 cases of scams involving RM441000 in losses. (Source: The Star)