Malaysia lost RM5.62 billion to scams in 3 years. Here's how they do it and how to avoid getting scammed.
My phone rang. A woman introduced herself as a bank officer. She told me I had an outstanding loan of a certain amount that I had never applied for. I told her that plainly. She did not miss a beat. She said my identity had probably been stolen to take out the loan, and that she would transfer me to their in-house police officer to help me sort it out.
That is when my antenna went up.
The "officer" came on the line. Polite and authoritative. He asked me to verify his identity by looking up the phone number of a police station in Ipoh. He said he would call me back from that exact number. A few minutes later, my phone rang again. The number matched the Ipoh police station perfectly.
But there was a problem. The call had a noticeable delay. A lag in the conversation that anyone who has ever made a VoIP call over the internet would recognise immediately. He was not calling from a police station. He was spoofing the number through a Voice over Internet Protocol system, using the real station number as a disguise while calling from somewhere else entirely.
I hung up. I called the actual Ipoh police station directly. A real officer answered. I told her everything. She confirmed it was a scam call, took down the original number, and thanked me.
I walked away with my money intact and hopefully gave the police something useful to work with. But I know that many Malaysians would not have been as fortunate. Because these scammers are not amateurs. They are organised, well-scripted, and getting smarter every year.
So let us talk about what is out there right now, and what you need to know.
The Numbers Are Terrifying
Before we get into the types, let us be clear about the scale of the problem.
Malaysia lost RM2.77 billion to financial scams in 2025 alone. Total losses from 2023 to 2025 combined hit RM5.62 billion. Of all that money, only RM34 million was recovered, and just RM6.7 million was actually returned to victims. That recovery rate is so low it should make every Malaysian stop and think.
This is not happening to other people. In Perak alone, 4,848 online fraud cases were recorded in 2025, with losses totalling RM125 million. Victims include students, civil servants, retirees, and private sector workers. Men and women almost equally. No demographic is safe.
The Macau Scam, The One That Called Me
This is the scam I experienced firsthand and it remains one of the most common in Malaysia.
The Macau Scam involves callers impersonating bank officers, police, Bank Negara Malaysia, or other government agencies. The script varies but the structure is always the same. They create a problem. A loan you did not take, a credit card registered in your name, a police investigation involving your account. They make you panic. Then they offer to help you fix it, usually by transferring money to a "safe account" or handing over your banking credentials.
The latest variant involves scammers calling victims to inform them they are eligible for government aid or incentives. They ask for your online banking username and password to "process the payment." What they actually do is drain your account.
The way to spot it is exactly what I did. The real police, Bank Negara, and your bank will never call you out of the blue to ask for your banking credentials, OTP, or TAC number. Full stop. No legitimate authority needs that information from you over the phone. And if someone claims to be calling from a government number, call that number yourself through the official directory to verify.
The Double Scam: Getting Scammed Twice
This one is particularly cruel and PDRM only flagged it in April 2026.
The targets are people who have already been scammed. Scammers find these victims, often through social media, and approach them posing as representatives of the National Scam Response Centre (NSRC). They offer to recover the lost money for an upfront fee. Desperate victims, already rattled by their first loss, pay the fee. Then another fee. Then another. The money never comes back.
Six cases have already been reported between 2025 and March 2026, with total losses of RM68,491. That number will grow.
The rule here is simple. The NSRC, PDRM, MCMC, Bank Negara, and banking institutions will only contact you if you have already made a fraud report to them. They will never approach you first. They will never ask for payment to recover your money. If someone offers to get your money back for a fee, they are a scammer.
Fake Google Alerts and Search Ads
Google Malaysia's own country managing director Ben King flagged this just days ago. Scammers are now mimicking official Google alerts, search advertisements, and mobile apps with near-perfect accuracy. You receive a message that looks exactly like a Google security alert. It says your account has a suspicious sign-in. Or your storage is full. Or your account will be disabled.
You click the link. You enter your credentials. And you have just handed your Google account, and potentially your banking apps linked to it, to someone sitting in a server farm somewhere.
King's advice is blunt and practical: pause before clicking any link, verify the source of any message, and never download apps from unfamiliar channels. Legitimate Google alerts will never ask you to enter your password through a link in an email or SMS.
Fake Investment Lessons
The Securities Commission flagged this in April 2026. Scammers run advertisements on social media promoting free investment lessons or trading courses. The lessons feel legitimate. They discuss real market concepts. They build trust slowly.
Then, at a certain point, the "trainer" tells participants that the Malaysian stock market is underperforming and suggests investing through a special platform. They send a link or an APK file to download. The platform looks like a real trading app. But it is a fraudulent system designed to steal your money and your personal data.
Never download investment apps from links sent through social media or messaging apps. Legitimate investment platforms are listed on the Securities Commission's website at sc.com.my.
Job Scams Targeting Students and Fresh Graduates
A growing trend is the targeting of younger Malaysians with part-time job offers and online task scams. The pitch sounds harmless, complete simple tasks online and earn easy money. What follows is a gradual escalation where victims are asked to deposit money to "unlock" higher-paying tasks, or are recruited unknowingly as money mules by allowing their bank accounts to be used for fraudulent transactions.
If a job offer requires you to use your personal bank account to receive and transfer money for someone else, walk away immediately. That is a money mule operation and you can be prosecuted even if you did not know the money was from illegal activity.
The Red Flags You Should Never Ignore
Whether it is a phone call, a message, or an online advertisement, here is your quick checklist:
- Any call that creates sudden panic about a loan, investigation, or frozen account is almost certainly a scam. No legitimate authority operates by inducing panic and demanding immediate action.
- Any request for your banking credentials, OTP, TAC, or PIN over the phone or through a link is a scam. No bank or government agency needs these from you.
- Any offer to recover lost money in exchange for an upfront payment is a scam. Money recovery does not work that way.
- Any investment opportunity that requires you to download an app through a link sent via WhatsApp or Telegram is almost certainly a scam.
- Any call with a noticeable audio delay, echoing, or unusual call quality from someone claiming to be a local authority is likely a VoIP spoofed call. Trust your ears.
What To Do If It Happens To You
If you receive a suspicious call, hang up. Call the actual institution directly using the number from their official website or the back of your card.
If money has already been taken, call your bank's fraud hotline immediately and contact the NSRC on 997. Every minute matters. Recovery chances drop significantly after 24 hours. Then file a police report. You can also reach PDRM's CCID Scam Response Centre at 03-2610 1559.
If you receive a suspicious online message or link, report it to MCMC at aduan.mc.gov.my or contact CyberSecurity Malaysia at 1-300-88-2999.
My Take
I was lucky. I knew enough to be suspicious, and I had the presence of mind to verify rather than panic. But I will be honest… the script was convincing. If I had been older, less tech-savvy, or just having a bad day, I might have been drawn in further than I was.
The people running these operations are professionals. They have scripts. They have fake websites, spoofed numbers, and elaborate multi-step procedures designed specifically to get past your defences before you realise what is happening. Do not underestimate them.
But here is the thing. They also rely entirely on one ingredient to make the scam work: your cooperation. The moment you hang up, stop clicking, or refuse to transfer money, the scam dies. They cannot take anything from you that you do not hand them.
So pause. Verify. And when something feels wrong, trust that feeling. It is usually right.
Malaysia lost RM5.62 billion to scams in three years. Let us make sure your money is not part of that number.
Kamarul Azwan (k.azwan@gmail.com) is a content creator under the Newswav Creator programme, where you get to express yourself, be a citizen journalist, and at the same time monetize your content & reach millions of users on Newswav. Log in to creator.newswav.com and become a Newswav Creator now!
The User Content (as defined on Newswav Terms of Use) above including the views expressed and media (pictures, videos, citations etc) were submitted & posted by the author. Newswav is solely an aggregation platform that hosts the User Content. If you have any questions about the content, copyright or other issues of the work, please contact creator@newswav.com.
