Scams are now one of the most common ways Malaysians lose money — not to a bad investment or a market crash, but to a stranger on the other end of a phone call, an SMS, or a WhatsApp message. The people who fall for them are not careless. They are ordinary, careful people caught on a bad day by a script that has been refined on thousands of victims before them.
This guide is the full-picture overview: the handful of red flags that appear in almost every scam, the golden rules that stop most of them cold, how to check an account or an investment before you pay, and — if it has already happened — exactly who to call and in what order. Save this page. The one number to remember is 997.
Important
Already been scammed or sent money you shouldn't have? Call 997 now.
997 is the National Scam Response Centre hotline, under the police, which says it operates 24/7 (BNM's FAQ still lists 8am to 8pm, so call your bank's 24-hour hotline if 997 does not answer). BNM says calls to the NSRC must be made within 24 hours of the incident; if more than 24 hours have passed, still call your bank and lodge a police report. The sooner the NSRC contacts the receiving bank, the better the chance of freezing the money before it disappears. Then lodge a police report, freeze your own account through your banking app and change your online-banking password.
How big is the scam problem in Malaysia?
Big enough that the government built a dedicated response centre for it. The National Scam Response Centre (NSRC) was set up as a joint operation between the police, Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC) and the banks, with a single hotline — 997 — as the front door. Police notices from 2026 say it runs 24/7 including public holidays. A call to 997 starts the response, but BNM says victims must still lodge a police report.
The scale shows up in the tools too. Semak Mule, the police portal for checking whether an account or phone number has been reported in a scam, has recorded more than 37 million visitors since it launched in October 2020 (PDRM, 31 October 2025). That is not 37 million victims — it is millions of Malaysians pausing to check before they pay, which is exactly the habit this guide is trying to build.
The uncomfortable truth is that scams keep working because they target trust and emotion, not intelligence. The defence is not being clever. It is having a few fixed rules you follow every time, regardless of how convincing the story sounds.
The five red flags in almost every scam
You do not need to recognise every scam type to stay safe. You need to recognise the pattern underneath them. Nearly every scam — from a fake parcel SMS to a million-ringgit investment fraud — carries most of these five signs.
| Red flag | What it looks like | Why scammers use it |
|---|---|---|
| It comes to you | An unexpected call, SMS, WhatsApp, or DM you didn't initiate | You had no time to prepare or verify |
| Urgency | "Act now", "your account will be frozen", "the offer ends today" | Panic switches off careful thinking |
| Secrecy | "Don't tell the bank / your family", "this is confidential" | Isolation stops someone talking you out of it |
| Move money or share a code | Transfer to a "safe account", buy vouchers, or read out an OTP/PIN | This is the actual theft — everything before it is setup |
| Too good to be true | Guaranteed returns, a prize you didn't enter, easy part-time income | The reward is the bait that makes you drop your guard |
If a message ticks even two or three of these boxes, treat it as a scam until you have proven otherwise through an independent, official channel.
The golden rules that stop most scams
Warning
No genuine bank, police officer, court, or government agency will ever:
- Ask you to transfer your money to a "safe account" — this account is always the scammer's.
- Ask for your OTP, PIN, full password, or card CVV — real staff never need these.
- Tell you to keep the matter secret from your family or your bank.
- Demand payment in gift cards, cryptocurrency, or vouchers.
- Pressure you to decide or pay immediately over the phone.
If a caller does any of these, hang up. It does not matter how official they sound or what caller ID appears — numbers and names are easily faked.
Beyond those, three habits protect you in almost every situation:
- Verify independently. If "your bank" or "the police" calls, hang up and call back on the official number printed on your bank card or found on the agency's real website — never the number they gave you, and never a link in their message.
- Slow the money down. Scams die when you wait. Sleep on any unexpected request to pay or invest. A real opportunity survives a 24-hour pause; a scam usually can't.
- Check before you pay. Run the account number or phone number through Semak Mule, and any investment through the SC's registers, before the money leaves your account — not after.
The main types of scams in Malaysia
Scammers repackage the same tricks under different stories. These are the ones Malaysians see most often. The tell is always the same underlying pattern above — the storyline just changes.
| Scam type | The story | The tell |
|---|---|---|
| Macau / impersonation scam | A "policeman", "BNM officer", or "court" says you're linked to a crime or unpaid fine | Real authorities never demand money transfers by phone |
| Investment scam | Guaranteed high returns, often via a slick app, "expert" group, or clone of a real firm | Not on any SC/BNM licensed register; returns sound too good |
| Phishing / smishing | An SMS or email with a link to "verify", "reactivate", or claim a refund | The link goes to a fake bank login that steals your details |
| Parcel / customs scam | A "courier" or "customs" says a parcel is held and a fee is due | You're asked to pay or share details for a parcel you didn't send |
| Job / part-time task scam | Easy online work — "like videos", "complete tasks" — that pays, then asks you to top up | You have to pay in to "unlock" earnings you never receive |
| Love / romance scam | An online partner you've never met eventually needs money for an emergency or a "shared investment" | Requests for money always arrive before you meet in person |
| Mule account recruitment | An offer to "rent" or "sell" your bank account, or a job that routes money through it | Letting money pass through your account makes you a suspect |
A word on that last one: agreeing to let someone use your bank account — even for a fee, even for a friend — can make you a money mule. That is a criminal offence, it can get your account frozen and your name into a police investigation, and it can damage your banking record. If anyone asks to use your account, refuse.
How to check before you pay or invest
Two free, official tools do most of the work. Use them as a reflex.
Tip
Before you transfer money to anyone new — Semak Mule.
Go to semakmule.rmp.gov.my (run by the police CCID) and enter the recipient's bank account number or mobile number. If it has been reported in fraud cases, you'll see a match — stop immediately. No match isn't a guarantee a brand-new account is clean, but it is a fast sanity check.
Tip
Before you invest in anything — check the licence.
- SC Investor Alert List (sc.com.my/investor-alert) — a public list of unlicensed operators, fake schemes, and clone firms flagged by the Securities Commission.
- SC Investment Checker (sc.com.my/investment-checker) — confirm whether a company is actually licensed to take your money.
- Bank Negara Malaysia Financial Consumer Alert (bnm.gov.my) — BNM's list of entities that are not authorised under the laws it enforces.
If a scheme is on an alert list, or you can't find it on any licensed register, that is your answer. Investing through an unlicensed operator means you are not protected by Malaysian securities law if it collapses.
If it has already happened: the first hour
If money has left your account, act in this order. Minutes matter — fraud recovery depends almost entirely on freezing the funds before they are moved on.
- Call 997 or your bank's scam hotline now (BNM says NSRC calls must be made within 24 hours of the incident; after that, still call your bank). The National Scam Response Centre links the police, BNM and the banks. This is your fastest route to freezing the receiving account.
- Freeze your own account and cards through your banking app, or call your bank's official 24-hour line. Change your online-banking password and revoke any device or access you don't recognise.
- Gather the evidence — screenshots, phone numbers, account numbers, transaction references, and any chat history. The NSRC and your bank will need these.
- Lodge a police report, and report the account or number on Semak Mule so others are warned.
- Follow up in writing. You can also contact BNMLINK on 1-300-88-5465 (Mon–Fri, 9am–5pm) for complaints or redress involving a licensed bank or insurer.
Do not send more money. A common second hit is a "recovery scam", where someone contacts you afterwards promising to get your money back — for an upfront fee. It is the same scammers, or their friends, coming back for the rest.
Key contacts — save these now
Every number and link below is an official channel. When in doubt, reach the agency through these, never through a contact a stranger gives you.
| Who | For | How to reach |
|---|---|---|
| National Scam Response Centre (NSRC) | You've been scammed / money sent — freeze & recall | Call 997 (BNM: within 24 hours of the incident; police say 24/7; BNM's FAQ lists 8am–8pm), then lodge a police report |
| Semak Mule (PDRM CCID) | Check an account or phone number before paying | semakmule.rmp.gov.my |
| Bank Negara Malaysia (BNMLINK) | Complaints / redress on a licensed bank or insurer | 1-300-88-5465 (Mon–Fri, 9am–5pm) |
| Securities Commission Malaysia | Check an investment / report an unlicensed scheme | sc.com.my/investor-alert · Investment Checker |
| Your bank's 24-hour hotline | Freeze your own account and cards | The number printed on the back of your bank card |
Staying safe from scams isn't about being suspicious of everyone. It's about having a few fixed rules you never break — verify independently, slow the money down, check before you pay — and knowing that if the worst happens, one number, 997, starts the whole response at once.
Amendment, 17 October 2026. We re-checked the hotline, hours and contact details in this guide against Bank Negara Malaysia (BNM) and Royal Malaysia Police (PDRM) pages on 17 October 2026. Corrected: (1) The guide said a call to 997 "counts as your police report" and removes the need to report separately. BNM's scams FAQ lists "call your bank's scam hotline, or the NSRC at 997" AND "lodge a police report", and a BNM Deputy Governor's speech says "victims must make a police report to furnish more detailed information". We found no official statement that a 997 call is a police report, so every such claim was removed and a police-report step added. (2) The guide said "free" 24-hour calls; PDRM notices of 1 March and 19 May 2026 say the NSRC operates 24/7 including public holidays, and BNM's 2025 annual report calls it a 24-hour hub, but a PDRM notice of 30 December 2025 and BNM's FAQ both give 8am to 8pm, so the guide now states the conflict and points to the bank's 24-hour hotline; we found no source for "free" and removed it. (3) The "37 million checks" figure is 37 million visitors since October 2020 (PDRM, 31 October 2025). (4) Added BNM's rule that calls to the NSRC must be made within 24 hours of the incident. Confirmed: BNMLINK on 1-300-88-5465, Monday to Friday 9am to 5pm excluding public holidays (BNM); Semak Mule launched October 2020 and at semakmule.rmp.gov.my (PDRM; the site itself would not load for us because of an incomplete TLS certificate chain, so we did not test it); the SC Investor Alert List and Investment Checker pages and BNM's Financial Consumer Alert page (bnm.gov.my/fca) exist; the NSRC is coordinated with PDRM, BNM, MCMC, the National Anti-Financial Crime Centre, banks and telcos, and is now under the Home Ministry (PDRM, 22 July 2026). This PR rewrote the Direct Answer that the earlier 17 October trim (note at the end of this guide) had shortened. It now ends "call your bank or 997, then lodge a police report" instead of "call 997", and restores "buy vouchers", "share an OTP", "government agency" and "yourself"; it drops "one lever" and "never one they gave you". It is 74 words.
Amendment, 17 October 2026 (short answer trimmed). The short answer at the top of this guide was cut from 87 to 75 words, to meet the 75-word limit for a quotable answer. Shortened; wording tightened, no figures changed. Removed or tightened: "buy vouchers", "ever", "do" (now "ask for that"), "yourself", "already", "immediately", "a number or link" (now "one"), and "the same lever" (now "one lever"). The "contacts you unexpectedly, creates urgency" condition and "court" are kept. No figure, rule, source or condition was added, every figure left in the answer was already in it and in the body, and the rest of the guide is unchanged.
Amendment, 17 October 2026 (link label). The link to our e-wallet comparison was labelled "Refund Rights", which implied a BNM e-wallet refund rule. We found no equivalent of the e-banking refund rule (which covers banks) for e-wallets, so the label now reads "Safety, Coverage, and What to Do" and the e-wallet guide's own claim is corrected. Evidence: docs/verification-log/evidence-followups-d-oct17/evidence.md.