If you have just realised you were scammed, take a breath — and then move fast. The single thing that decides whether you get your money back is how quickly you act, and the first move is one phone call.
Do not waste time messaging the scammer, posting a warning online, or gathering every screenshot first. That comes later. Right now, the money may still be sitting in the account you sent it to, and there is a short window to freeze it before it disappears.
Important
The 60-second version: call 997 now.
997 is the National Scam Response Centre — the police, Bank Negara Malaysia, MCMC and the banks working together. PDRM says it operates 24/7; BNM's FAQ still lists 8am to 8pm, so if 997 does not answer, call your bank's 24-hour hotline. Tell them you've been scammed and give the account or number you paid. They can ask the receiving bank to freeze the money. BNM says to call the NSRC within 24 hours of the incident and to lodge a police report; if more than 24 hours have passed, still call your bank and lodge a police report. Make this call before you do anything else on this page.
The first hour: exactly what to do
Work through these in order. Steps 1 and 2 are the ones that actually protect your money — do them before anything else.
-
Call 997 immediately. Say clearly: "I have been scammed / I transferred money to a scammer." Give them the recipient's bank account number or e-wallet/phone number, the amount, and when you sent it. The National Scam Response Centre will start the process of freezing the receiving account. Then lodge a police report; BNM's FAQ lists it as a separate step.
-
Freeze your own account and cards. Open your banking app and freeze your cards / account, or call your bank's official 24-hour line (the number on the back of your card). Change your online-banking password and log out or revoke any device or session you don't recognise. If a card is linked to a compromised e-wallet, remove it so no further reloads can happen.
-
Lodge a police report and gather your evidence — but only after steps 1 and 2. Save screenshots of the chat, the payment confirmation, the recipient's account/phone number, the transaction reference, and any website or number the scammer used. The NSRC and your bank will ask for these.
-
Report the account or number on Semak Mule (semakmule.rmp.gov.my) so the police database is updated and others are warned before they pay.
-
Follow up in writing with your bank. Keep any reference number from your 997 call and your police report. If a licensed bank or insurer is involved and isn't responding, escalate to BNMLINK on 1-300-88-5465 (Mon–Fri, 9am–5pm).
Tip
What to have ready when you call 997: your own bank details, the recipient's account number or phone number, the exact amount and time of the transfer, and how the scammer contacted you. Having these to hand makes the freeze request faster — but if you don't have all of them, call anyway. Don't delay the call to hunt for a reference number.
Two situations — the difference decides your refund
Not every scam is the same in the eyes of the rules, and this affects whether you have a refund right.
You transferred the money yourself (an "authorised push payment" scam). You were deceived into sending it — a fake investment, a "policeman" demanding a transfer, a fake seller. Because you authorised the payment, there is no automatic refund right. Your recovery depends entirely on the police and the receiving bank freezing the funds through 997 before they're moved. This is why speed matters so much here.
Someone took the money without your permission (an unauthorised transaction). Your card, account, or e-wallet was used by someone else — often after phishing or a stolen OTP. Under BNM's policy for unauthorised e-banking transactions (from 1 October 2024), a bank cannot hold you responsible for fraud losses unless it can prove you acted fraudulently, refused to cooperate, or failed to carry out obligations the bank had informed you of (not disclosing your credentials, keeping your device secure, reporting a breach promptly). Report it to your bank immediately and file a police report.
In both cases the first two steps are identical: call 997, lock down your accounts. The difference only changes what happens next.
If it was an e-wallet or bank card
For unauthorised transactions on Touch 'n Go eWallet, GrabPay, Boost, a bank card, or any licensed wallet:
- Change your PIN and app password inside the app straight away.
- Report the unauthorised transaction via in-app support — note the time and transaction references.
- File a police report — operators and banks may ask for it.
- Escalate to BNMLINK (1-300-88-5465) if the operator doesn't respond, or doesn't resolve your dispute within its stated timeframe.
- Revoke linked card access in your bank app so no further reloads can be pulled.
BNM's unauthorised-transaction policy covers licensed banks and credit card issuers; we did not find an equivalent rule for e-wallets, so ask your operator what protection applies. Report fast and keep every reference number.
Watch out for the "recovery scam"
Warning
If someone contacts you after the scam offering to get your money back — it's a second scam.
Scammers keep lists of recent victims. Days or weeks later, a "cyber agent", "lawyer", "hacker", or even a fake fellow-victim will message you promising to recover your loss for an upfront fee. Real recovery only ever goes through 997, the police, and your bank — and never asks you to pay a private individual first. Don't send another cent. Report the approach on 997 too.
Key contacts — in the order you'll need them
| Step | Who | How to reach |
|---|---|---|
| 1. Freeze the money + report | National Scam Response Centre (NSRC) | Call 997 (BNM: within 24 hours of the incident; PDRM: 24/7; BNM's FAQ: 8am–8pm), then lodge a police report |
| 2. Freeze your own account | Your bank's 24-hour hotline | Number on the back of your bank card |
| 3. Report the account/number | Semak Mule (PDRM CCID) | semakmule.rmp.gov.my |
| 4. Escalate a licensed bank/insurer | Bank Negara Malaysia (BNMLINK) | 1-300-88-5465 (Mon–Fri, 9am–5pm) |
Being scammed is not a sign you were careless — these scripts are designed to catch careful people on a bad day. What you do in the next hour matters far more than how it happened. Make the call to 997, lock down your accounts, and let the response start working while the money may still be frozen where it landed.
For the bigger picture — how these scams work and how to spot the next one before it costs you — read our full guide to financial scams in Malaysia.
Amendment, 17 October 2026. We re-checked the hotline, hours, refund rules and contact details in this guide against Bank Negara Malaysia (BNM) and Royal Malaysia Police (PDRM) documents on 17 October 2026. Corrected: (1) The guide said a call to 997 "counts as your police report". BNM's scams FAQ lists "call your bank's scam hotline, or the NSRC at 997" AND "lodge a police report", and a BNM Deputy Governor's speech says "victims must make a police report to furnish more detailed information". We found no official statement that a 997 call is a police report, so the claim was removed everywhere and a police-report step added. (2) The guide gave no deadline; BNM's FAQ says calls to the NSRC "must be made within 24 hours of the scam incident". (3) Hours: PDRM notices of 1 March and 19 May 2026 say the NSRC operates 24/7 including public holidays, and BNM's 2025 annual report calls it a 24-hour hub, but a PDRM notice of 30 December 2025 and BNM's FAQ give 8am to 8pm, so the guide states the conflict and points to the bank's 24-hour hotline. (4) The refund rule: the guide said BNM rules require refunds "provided you were not negligent" and applied this to e-wallets. BNM's policy document for banks (28 June 2024, in effect 1 October 2024) says a bank cannot hold a customer responsible unless it proves fraud, refusal to cooperate, or failure to protect credentials and report a breach, and excludes payments the customer willingly approved when deceived; the credit card policy document of 19 December 2025 has a parallel rule; we found no equivalent rule for e-wallets in BNM's e-money policy document, so that claim was removed. Confirmed: BNMLINK 1-300-88-5465, Monday to Friday 9am to 5pm excluding public holidays; Semak Mule at semakmule.rmp.gov.my (the site would not load for us because of an incomplete TLS certificate chain, so it was not tested). This PR rewrote the Direct Answer that the earlier 17 October trim (note at the end of this guide) had shortened. It no longer says a call to 997 "files your report in one step" (BNM lists the police report as a separate step); it now starts with "call your bank's scam hotline or 997" and BNM's 24-hour condition for NSRC calls, and adds "lodge a police report"; it drops "Do these in order" and "almost entirely". It is 68 words.
Amendment, 17 October 2026 (short answer trimmed). The short answer at the top of this guide was cut from 77 to 74 words, to meet the 75-word limit for a quotable answer. Shortened; wording tightened, no figures changed. Removed or tightened: the words "almost entirely" and "very". No figure, rule, source or condition was added, every figure left in the answer was already in it and in the body, and the rest of the guide is unchanged.
Amendment, 17 October 2026 (link label). The link to our e-wallet comparison was labelled "Refund Rights", which implied a BNM e-wallet refund rule. We found no equivalent of the e-banking refund rule (which covers banks) for e-wallets, so the label now reads "Safety, Coverage, and What to Do" and the e-wallet guide's own claim is corrected. Evidence: docs/verification-log/evidence-followups-d-oct17/evidence.md.