Scams are now one of the most common ways Malaysians lose money — not to a bad investment or a market crash, but to a stranger on the other end of a phone call, an SMS, or a WhatsApp message. The people who fall for them are not careless. They are ordinary, careful people caught on a bad day by a script that has been refined on thousands of victims before them.
This guide is the full-picture overview: the handful of red flags that appear in almost every scam, the golden rules that stop most of them cold, how to check an account or an investment before you pay, and — if it has already happened — exactly who to call and in what order. Save this page. The one number to remember is 997.
Important
Already been scammed or sent money you shouldn't have? Call 997 now.
997 is the National Scam Response Centre hotline, run by the police and open 24 hours. Call before you do anything else — the sooner the NSRC contacts the receiving bank, the better the chance of freezing the money before it disappears. The call counts as your police report. Then freeze your own account through your banking app and change your online-banking password.
How big is the scam problem in Malaysia?
Big enough that the government built a dedicated response centre for it. The National Scam Response Centre (NSRC) was set up as a joint operation between the police, Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC) and the banks, with a single hotline — 997 — as the front door. As of 2026 that line runs around the clock, and a call to it is treated as an official police report so victims do not lose time filing paperwork while their money moves.
The scale shows up in the tools too. Semak Mule, the police portal for checking whether an account or phone number has been reported in a scam, has logged more than 37 million checks since it launched in 2020. That is not 37 million victims — it is millions of Malaysians pausing to check before they pay, which is exactly the habit this guide is trying to build.
The uncomfortable truth is that scams keep working because they target trust and emotion, not intelligence. The defence is not being clever. It is having a few fixed rules you follow every time, regardless of how convincing the story sounds.
The five red flags in almost every scam
You do not need to recognise every scam type to stay safe. You need to recognise the pattern underneath them. Nearly every scam — from a fake parcel SMS to a million-ringgit investment fraud — carries most of these five signs.
| Red flag | What it looks like | Why scammers use it |
|---|---|---|
| It comes to you | An unexpected call, SMS, WhatsApp, or DM you didn't initiate | You had no time to prepare or verify |
| Urgency | "Act now", "your account will be frozen", "the offer ends today" | Panic switches off careful thinking |
| Secrecy | "Don't tell the bank / your family", "this is confidential" | Isolation stops someone talking you out of it |
| Move money or share a code | Transfer to a "safe account", buy vouchers, or read out an OTP/PIN | This is the actual theft — everything before it is setup |
| Too good to be true | Guaranteed returns, a prize you didn't enter, easy part-time income | The reward is the bait that makes you drop your guard |
If a message ticks even two or three of these boxes, treat it as a scam until you have proven otherwise through an independent, official channel.
The golden rules that stop most scams
Warning
No genuine bank, police officer, court, or government agency will ever:
- Ask you to transfer your money to a "safe account" — this account is always the scammer's.
- Ask for your OTP, PIN, full password, or card CVV — real staff never need these.
- Tell you to keep the matter secret from your family or your bank.
- Demand payment in gift cards, cryptocurrency, or vouchers.
- Pressure you to decide or pay immediately over the phone.
If a caller does any of these, hang up. It does not matter how official they sound or what caller ID appears — numbers and names are easily faked.
Beyond those, three habits protect you in almost every situation:
- Verify independently. If "your bank" or "the police" calls, hang up and call back on the official number printed on your bank card or found on the agency's real website — never the number they gave you, and never a link in their message.
- Slow the money down. Scams die when you wait. Sleep on any unexpected request to pay or invest. A real opportunity survives a 24-hour pause; a scam usually can't.
- Check before you pay. Run the account number or phone number through Semak Mule, and any investment through the SC's registers, before the money leaves your account — not after.
The main types of scams in Malaysia
Scammers repackage the same tricks under different stories. These are the ones Malaysians see most often. The tell is always the same underlying pattern above — the storyline just changes.
| Scam type | The story | The tell |
|---|---|---|
| Macau / impersonation scam | A "policeman", "BNM officer", or "court" says you're linked to a crime or unpaid fine | Real authorities never demand money transfers by phone |
| Investment scam | Guaranteed high returns, often via a slick app, "expert" group, or clone of a real firm | Not on any SC/BNM licensed register; returns sound too good |
| Phishing / smishing | An SMS or email with a link to "verify", "reactivate", or claim a refund | The link goes to a fake bank login that steals your details |
| Parcel / customs scam | A "courier" or "customs" says a parcel is held and a fee is due | You're asked to pay or share details for a parcel you didn't send |
| Job / part-time task scam | Easy online work — "like videos", "complete tasks" — that pays, then asks you to top up | You have to pay in to "unlock" earnings you never receive |
| Love / romance scam | An online partner you've never met eventually needs money for an emergency or a "shared investment" | Requests for money always arrive before you meet in person |
| Mule account recruitment | An offer to "rent" or "sell" your bank account, or a job that routes money through it | Letting money pass through your account makes you a suspect |
A word on that last one: agreeing to let someone use your bank account — even for a fee, even for a friend — can make you a money mule. That is a criminal offence, it can get your account frozen and your name into a police investigation, and it can damage your banking record. If anyone asks to use your account, refuse.
How to check before you pay or invest
Two free, official tools do most of the work. Use them as a reflex.
Tip
Before you transfer money to anyone new — Semak Mule.
Go to semakmule.rmp.gov.my (run by the police CCID) and enter the recipient's bank account number or mobile number. If it has been reported in fraud cases, you'll see a match — stop immediately. No match isn't a guarantee a brand-new account is clean, but it is a fast, free sanity check that has stopped millions of payments.
Tip
Before you invest in anything — check the licence.
- SC Investor Alert List (sc.com.my/investor-alert) — a public list of unlicensed operators, fake schemes, and clone firms flagged by the Securities Commission.
- SC Investment Checker (sc.com.my/investment-checker) — confirm whether a company is actually licensed to take your money.
- Bank Negara Malaysia Financial Consumer Alert (bnm.gov.my) — BNM's list of entities that are not authorised under the laws it enforces.
If a scheme is on an alert list, or you can't find it on any licensed register, that is your answer. Investing through an unlicensed operator means you are not protected by Malaysian securities law if it collapses.
If it has already happened: the first hour
If money has left your account, act in this order. Minutes matter — fraud recovery depends almost entirely on freezing the funds before they are moved on.
- Call 997 now. The National Scam Response Centre reaches the police, BNM and the banks at once. This is your fastest route to freezing the receiving account, and it counts as your police report.
- Freeze your own account and cards through your banking app, or call your bank's official 24-hour line. Change your online-banking password and revoke any device or access you don't recognise.
- Gather the evidence — screenshots, phone numbers, account numbers, transaction references, and any chat history. The NSRC and your bank will need these.
- Report the account or number on Semak Mule so others are warned.
- Follow up in writing. You can also contact BNMLINK on 1-300-88-5465 (Mon–Fri, 9am–5pm) for complaints or redress involving a licensed bank or insurer.
Do not send more money. A common second hit is a "recovery scam", where someone contacts you afterwards promising to get your money back — for an upfront fee. It is the same scammers, or their friends, coming back for the rest.
Key contacts — save these now
Every number and link below is an official channel. When in doubt, reach the agency through these, never through a contact a stranger gives you.
| Who | For | How to reach |
|---|---|---|
| National Scam Response Centre (NSRC) | You've been scammed / money sent — freeze & recall | Call 997 (24 hours; counts as a police report) |
| Semak Mule (PDRM CCID) | Check an account or phone number before paying | semakmule.rmp.gov.my |
| Bank Negara Malaysia (BNMLINK) | Complaints / redress on a licensed bank or insurer | 1-300-88-5465 (Mon–Fri, 9am–5pm) |
| Securities Commission Malaysia | Check an investment / report an unlicensed scheme | sc.com.my/investor-alert · Investment Checker |
| Your bank's 24-hour hotline | Freeze your own account and cards | The number printed on the back of your bank card |
Staying safe from scams isn't about being suspicious of everyone. It's about having a few fixed rules you never break — verify independently, slow the money down, check before you pay — and knowing that if the worst happens, one number, 997, starts the whole response at once.