Overview: The scam landscape
Malaysia is living through what officials and analysts alike describe as an unprecedented scam crisis. Fraud has shifted from a scattering of isolated cons into an organised, often cross-border industry that drains billions of ringgit from ordinary people every year, reaches every part of society from students to retirees, and adapts its methods faster than most victims can keep up.
Because the stolen money moves through bank accounts, telephone lines, investment platforms and online marketplaces all at once, the problem sits at the intersection of several very different systems — which is precisely what makes it so difficult to stop.
For that reason, no single organisation owns the fight against scams. Instead, a network of government agencies, regulators and enforcement bodies each watches its own corner of the landscape — banking, securities, telecommunications, commerce and cyberspace — and feeds into a shared, coordinated response.
Knowing who these bodies are in Malaysia and what each is responsible for makes the rest of this report easier to follow and, more practically, tells the public exactly where to turn when something goes wrong. This article covers the essential information on various types of frauds and scams in Malaysia, involving monetary and non-monetary losses
Who monitors and fights scams in Malaysia
At the centre of the response sits the National Scam Response Centre (NSRC), established in October 2022 as the country’s rapid-response hub for online financial fraud. Its emergency hotline, 997, lets a victim report a scam the moment it happens so that authorities can try to freeze the receiving account before the money is moved on. Originally coordinated by the National Anti-Financial Crime Centre (NFCC) under the Prime Minister’s Department, the NSRC became a round-the-clock, police-led operation from July 2025, with day-to-day command handed to the Royal Malaysia Police (PDRM) and, specifically, its Commercial Crime Investigation Department (CCID). The CCID is the frontline investigator of scam cases, tracing funds, freezing accounts, making arrests and running the public account-checking tools described below.
Guarding the financial system itself are two central regulators. Bank Negara Malaysia (BNM), the central bank, oversees the banks and has driven most of the recent protective controls — binding each account to a single trusted device, the customer “kill switch,” cooling-off periods and the phasing out of the easily intercepted SMS one-time passcode — while maintaining a Financial Consumer Alert List of entities that falsely claim to be licensed. The Securities Commission Malaysia (SC) polices the investment world, publishing the widely used Investor Alert List of unauthorised schemes and promoters, offering licence checks and an online “scam meter,” and prosecuting investment fraud. Because fake investments cause the largest losses in the country, the SC’s alert list is one of the most valuable free tools available to the public.
Other regulators cover the channels through which scams travel. The Malaysian Communications and Multimedia Commission (MCMC) governs telecommunications and online content, blocking scam numbers, tackling caller-ID spoofing and taking down fraudulent websites and advertisements. The Ministry of Domestic Trade and Cost of Living (KPDN) handles consumer protection and acts against errant online sellers, which places much e-commerce fraud within its remit, while the Companies Commission of Malaysia (SSM) allows the public to verify whether a business is genuinely registered before parting with any money.
Rounding out the network, the Ministry of Digital sets national policy on emerging threats such as AI-generated deepfakes, while its agency CyberSecurity Malaysia, through the Cyber999 service, responds to phishing sites, malware and other cyber incidents. The Credit Counselling and Debt Management Agency (AKPK) supports victims left in financial distress. Underpinning all of this are two public-facing monitoring tools worth knowing by name: Semak Mule, the PDRM/CCID portal that lets anyone check whether a bank account, phone number or company has been flagged for scam activity, and the National Fraud Portal, a shared platform that helps banks trace and freeze suspect funds across institutions far more quickly than before.
Malaysian Fraud & Scam - A crisis costing billions
Scams in Malaysia are no longer an occasional misfortune that happens to other people. They have grown into a national problem measured in billions of ringgit.
Reported losses from online fraud rose from about RM1.57 billion in 2024 to roughly RM2.7 billion in 2025, and the government's own figures put the total even higher, at close to RM2.97 billion.
In a single year, the money lost jumped by around 76 percent. These are only the cases that were reported; because many victims never come forward, the true figure is almost certainly larger still.
Two categories stand out within that total. Fake investment schemes caused the greatest financial damage, accounting for around RM1.37 billion — more than half of everything lost to scams in the country. Meanwhile, telephone impersonation scams, often called “Macau scams,” produced the highest number of victims, with 28,698 reported cases. In other words, one type of scam takes the most money from a smaller group of people, while another reaches the largest number of victims, even if each individual loss is smaller. Understanding that distinction is the key to understanding the whole landscape.
Why the problem is growing so quickly
Several forces are pushing these numbers upward at the same time. The first is professionalisation. Scams are no longer the work of lone opportunists; they are run by organised syndicates operating industrial-scale call centres, sometimes from across the border, complete with scripts, staff and quotas. The second is the shift to digital money. As more of daily life moves to online banking, e-wallets and QR payments, scammers have far more doors to knock on and far faster ways to move stolen funds once they get in.
The third force is technology itself. Fraud criminals in Malaysian are beginning to use artificial intelligence to clone voices, fake video endorsements from public figures, and generate convincing fake identities for romance and investment cons.
“What used to take real acting skill can now be produced by software. Taken together, these trends explain why the losses are not merely rising but accelerating, and why last year’s defences are not always enough to stop this year’s scams.” said Shahid Shayaa, CEO & Founder of Berkshire Media.
Reported losses from online fraud rose from about RM1.57 billion in 2024 to roughly RM2.7 billion in 2025, and the government's own figures put the total even higher, at close to RM2.97 billion.
Frauds & Scams: Insights Report
You can now access the frauds & scams insights with detailed information about various types of frauds and scams via our interactive dashboard.
Common fraud and scams in Malaysia
1. Fake investments and crypto schemes
This is the single largest source of losses in Malaysia, responsible for around RM1.37 billion across 9,296 cases in 2025. The pattern is consistent: victims are lured through social-media advertisements, chat groups or even a budding online romance into a trading platform that looks entirely genuine.
The investment scam online platform shows healthy profits, and small early withdrawals are allowed so that trust builds.
“Once the victim commits a larger sum, the withdrawals suddenly freeze and the money is gone, quickly layered through other accounts and often converted into cryptocurrency” said Ezila, fraud and scam monitoring expert who spent 3 years analyzing various online scams on social media.
Professionals, retirees and higher-income earners are common targets. A particularly cruel twist is the “recovery scam,“ in which people who have already been cheated are approached again by fraudsters posing as agents who promise to get their money back — for a fee.
2. Telephone impersonation — the “Macau scam”
This is the highest-volume scam in Malaysia, and it works on fear rather than greed. A caller pretends to be from the police, the central bank, the tax authority or Customs, and tells the victim they are somehow linked to money laundering or drug trafficking.
The victim is frightened, isolated on the call, and pressured to transfer their savings into a so-called “safe account” for verification — or even to hand over their ATM card and PIN. Retirees, homemakers and civil servants are especially vulnerable.
A newer variation of Macau scam in 2025-2026 uses silent AI-enabled calls to quietly harvest a person's voice, which can then be cloned using AI technologies.
The single most important thing to remember is that no genuine agency will ever call and instruct you to move your money. If you are not sure, it is better not answer a silent call, or better still, always check with your banks, insurance agent or any entities that you have dealt with in the past for confirmation.
3. Phishing and banking malware
This category cost Malaysians about RM458 million in 2025. Here the attack comes through a link or a file rather than a phone call. A text message or email carries a malicious link, or an app that the victim is persuaded to install. A fake bank login page then captures the username and password, and one-time passcodes are intercepted, allowing the criminals to drain the account before the victim realises anything is wrong. The rise of malicious apps installed from links outside the official app stores has made this threat sharper, and older users who are less familiar with these tricks are often the ones caught out.
4. Online shopping fraud
With nearly 15,000 cases in 2025, e-commerce fraud is the everyday version of the problem. It usually involves a shop or listing that does not really exist, prices that seem too good to pass up, and a nudge to pay off-platform or through a QR code. The goods never arrive, or turn out to be counterfeit. These scams spike sharply during festive seasons such as Hari Raya, when shopping volumes and the rush to grab a bargain both climb.
The machinery behind fraud and scam in Malaysia
Behind every scam sits a quieter but essential piece of the puzzle: the mule account. These are ordinary bank accounts that have been rented, sold or lent out — often for as little as RM100 to RM600 — and used to receive and move stolen money. By passing funds rapidly through many such accounts and then cashing out or converting to cryptocurrency, syndicates break the trail between the victim and themselves.
This is why money laundering and mule accounts are the most-discussed scam theme in Malaysia's online conversation: the public has come to understand that the real fight is over the financial plumbing, not just the individual con.
The people recruited as mules are frequently students and low-income individuals who may not fully grasp that they are committing a serious crime. Enforcement has become far tougher — new provisions in the Penal Code now carry penalties of up to ten years in prison and fines of RM150,000 — and large operations in late 2025 led to more than 2,100 arrests.
The message to the public is blunt but important: never rent, sell or lend your bank account, because doing so is a crime with real jail time attached.
Other popular scams in Malaysia that cost more than money
1. Job scams and human trafficking
Some scams cost people their freedom, not just their savings. Fraudulent advertisements promise well-paid overseas or online jobs, ask for upfront fees or personal documents, and in the worst cases lure victims into forced-labour compounds in countries such as Myanmar, Cambodia and Laos, where they are made to run scams on others. More than 800 Malaysians have been detained abroad in operations linked to this kind of trafficking. Simpler “like-and-earn” microjob scams, which pay tiny sums for small online tasks before demanding a deposit, are also spreading widely.
2. Romance scams
Romance fraud is a long game. A fake profile on a dating or social app builds an emotional bond over weeks or months before any money is mentioned, and increasingly these cons merge into fake crypto investments — a combination sometimes called “pig butchering.” Single, divorced or widowed adults, often middle-aged or older, are the usual targets, and AI-generated faces and personas now make the deception harder to spot. Because shame keeps so many victims silent, this is one of the most under-reported scams of all, which means the real damage is greater than any official figure suggests.
The threat on the horizon: AI-powered deception
The newest and fastest-evolving danger is fraud powered by artificial intelligence. This includes deepfake videos of leaders and celebrities appearing to endorse investment schemes, cloned voices of family members or officials used to manufacture fake emergencies, and the silent calls mentioned earlier that harvest a person’s voice for later use. Recorded cases and losses are still relatively small — more than 450 cases and around RM2.72 million — but this is the category where the response is weakest. There is not yet a law requiring deepfakes to be labelled, detection tools are still immature, and the technology is advancing faster than policy can keep up. It is, in short, the area to watch most closely over the coming year.
What the public is saying
Our social media monitoring analysis presented in the dashboard below incorporates public conversation, and what we found was -across roughly 13,835 online mentions in a three-month window, the mood is overwhelmingly negative — more than half of all mentions carried anger or anxiety, and the overall net sentiment sits deep in negative territory. The discussion reached an audience of some 236.9 million and generated over a million interactions, so this is not a fringe concern but a mainstream anxiety.
Malaysia Fraud & Scam Insights
Top Fraud & Scam Topics
Ranked by financial impact, case volume, conversation share and emerging risk. Click a topic to expand its full profile.
What we found:
The volume of conversation nearly tripled from the middle of June onward, peaking at more than 2,300 mentions in a single week in early July. That surge was driven by a wave of court seizures of laundered money, mass arrests of mule-account operators, and several high-profile impersonation cases.
Notably, the Malaysians are not only angry about being cheated; the conversation was focused on the financial machinery behind the scams and on whether stolen money is ever recovered. That frustration over low recovery rates is the single loudest note in the entire conversation, continued to be a concern for Malaysians at large, despite educational awareness played by the media outlets and experiential sharing by victims in social media.
What the authorities are doing about it
The response has intensified considerably. At its centre is the National Scam Response Centre and its hotline, 997, which since July 2025 has operated around the clock under police leadership and can trigger an immediate request to freeze a suspect account. Speed matters enormously here: the sooner a scam is reported, the better the chance that money can be stopped before it disappears.
Encouragingly, the proportion of frozen funds being returned to victims has been climbing, rising to around 49 percent in the first months of 2026 from just 29 percent previously.
Alongside the hotline, the central bank (i.e Bank Negara) has rolled out a series of protective controls, including binding each bank account to a single trusted device, a “kill switch” that lets customers instantly suspend their own accounts, cooling-off periods on high-risk changes, and the phasing out of the easily intercepted SMS one-time passcode in favour of stronger methods.
Tougher laws now target mule accounts directly, major raids have shut down large call-centre operations, and from mid-2026 negligent e-wallet providers are required to compensate scam victims within seven working days. Taken together, this is a genuinely coordinated effort across the police, the central bank, the securities and communications regulators and the banks themselves.
Where the gaps still lie
For all that progress, honest reading of the data shows the defences are not yet winning. The most persistent frustration is that recovery remains low — only a small fraction of reported losses is ever returned — because money moves faster than accounts can be frozen, especially when it crosses several banks or leaves the country as cryptocurrency. On the legal side, the great majority of fraud still falls outside the frameworks that would guarantee victims compensation, and there is as yet no law addressing deepfakes. Technologically, tracing crypto across borders is difficult, deepfake detection is immature, and malicious apps continue to slip onto phones.
Perhaps most importantly, the people most at risk — retirees who fall for impersonation calls, and young people recruited as mules — are precisely the groups hardest to reach with awareness campaigns, while shame keeps romance and job-scam victims from reporting at all. Closing these gaps is less about any single new rule and more about making reporting faster, holding platforms and telcos more accountable, and reaching vulnerable people before the scammers do.
How to protect yourself and the people you love
The reassuring truth buried in all this data is that a handful of simple habits stop the great majority of scams. The most powerful of them is also the simplest: slow down. Scammers manufacture panic and urgency precisely because a calm person is a safe person, and real institutions always give you time to think. When a call or message pressures you to act immediately, treat that pressure itself as the warning sign.
Whenever anyone contacts you claiming to be from a bank, the police or a government agency, hang up and verify independently by calling the official number yourself — never the number they provide. Bear in mind two rules that never have exceptions: no genuine bank or agency will ever ask for your one-time passcode, PIN or password, and none of them will ever call to make you transfer money into a “safe” or “verification” account. Before putting money into any investment, check the Securities Commission’s Investor Alert List, and remember that a guaranteed high return is, in practice, a guarantee of a scam.
Guard your bank account as you would your identity: never rent, sell or lend it, because doing so is a criminal offence. Be wary of any request to install an app from a link or file rather than the official app store, and be especially cautious of a new online friend or romantic interest who, sooner or later, begins asking for money. Above all, share these habits with older relatives, who are the most frequently targeted and the least likely to have heard the warnings. A single conversation over dinner can prevent a devastating loss.
If it has already happened
If you suspect you have been scammed, the most important thing is to act within minutes rather than hours. Call the National Scam Response Centre on 997 straight away, because the speed of your report directly decides whether the money can still be frozen. There is no shame in being caught out — these syndicates are professionals who deceive thousands of careful people every year — and reporting quickly not only gives you the best chance of recovery but also helps the authorities disrupt the network before it reaches its next victim.
Quick reference — who to contact
If you suspect you have been scammed, the most important thing is to act within minutes rather than hours. Call the National Scam Response Centre on 997 straight away, because the speed of your report directly decides whether the money can still be frozen. There is no shame in being caught out — these syndicates are professionals who deceive thousands of careful people every year — and reporting quickly not only gives you the best chance of recovery but also helps the authorities disrupt the network before it reaches its next victim.
| If you need to… | Contact |
| Suspected scam — report immediately | NSRC hotline 997 (24 hours) |
| Police emergency | 999 |
| Banking enquiries | BNMTELELINK 1-300-88-5465 |
| Check a suspicious account or number | Semak Mule — semakmule.rmp.gov.my |
| Verify an investment | SC Investor Alert List |
| Report a cyber incident | Cyber999 (CyberSecurity Malaysia) |
About this analysis
This accompanies Berkshire Media’s Malaysia Fraud & Scam Dashboard and covers the data period spanning the first half of 2026. It draws on official and regulatory disclosures from the police and central bank, Malaysian news and court reporting, and social-media monitoring across news portals and public platforms, supplemented by Berkshire Media’s own analyst assessment. Loss and case figures rely on full-year 2025 official reporting.
A note on the numbers: scam losses are widely under-reported, particularly for romance and job scams where stigma is high, so the figures here should be read as a floor rather than a ceiling. Definitions also vary between agencies, which means totals from different sources are not always directly comparable.
This document is provided for general information only. It does not constitute professional, investment or business advice, and should not be relied upon as a substitute for independent verification. Berkshire Media accepts no liability for decisions made on the basis of this analysis.
Free Consultation & Demo
About the Author
Shahid Shayaa is the founder and managing director of Berkshire Media. He specializes in data-driven communication strategies and insights using social data analytics, social media monitoring tools and machine learning text algorithms for more than 13 years. As an expert in the field of media monitoring, issue management and managing reputation risks for companies, he is involved in various research studies in this field and published various scientific papers on social data analytics, sentiment analysis and back-end algorithms on consumer sentiment, emotions and behaviour for marketers and campaign managers.
His research work and studies have been cited more than 467 times, inspiring new research in the field of social analytics in Malaysia. You may view his work here.
Social Media Listening Analysis
13,835 mentions · Malaysia-focused.