How to Spot Online Scams in Malaysia: 10 Red Flags to Watch For

Online scams in Malaysia keep evolving. Scammers pose as banks, couriers, government officers, online sellers, employers and even friends or family. They are patient, convincing and very good at creating panic. Anyone can be targeted, regardless of age or education.

The good news is that most scams share the same warning signs. This guide covers ten red flags to watch for, practical habits that protect you, and the steps to take immediately if you think you have been scammed.

10 red flags of an online scam

1. Urgency and pressure. Messages saying your account will be frozen, a warrant has been issued or an offer expires in minutes are designed to stop you thinking clearly.
2. Requests for OTPs, TACs, PINs or passwords. Your bank will never ask you for these. Anyone who does is a scammer.
3. Unexpected links. SMS, WhatsApp or email links claiming a parcel is stuck, a bill is overdue or a prize is waiting.
4. Requests to install an app. Especially APK files sent through chat. These can give scammers control of your phone and banking apps.
5. Calls from "officers". Someone claiming to be from the police, a court or a government agency who asks you to transfer money to "clear your name".
6. Too-good-to-be-true investments. Promises of guaranteed high returns, often shared through Telegram or WhatsApp groups with fake success screenshots.
7. Job offers that pay for simple tasks. Liking videos or reviewing products for money, followed by requests to "top up" to unlock earnings.
8. Marketplace sellers who want to move off-platform. Asking you to pay by direct bank transfer outside the app removes your buyer protection.
9. Romance that turns to money. An online partner you have never met in person who suddenly needs money for an emergency or customs fee.
10. Familiar names with new numbers. A "friend" or "relative" messaging from an unknown number asking for an urgent loan.

Habits that keep you safe

• Never share OTPs, TACs, PINs or passwords with anyone, for any reason.
• Only install apps from the official Google Play Store or Apple App Store.
• Type your bank's website address yourself or use the official app instead of clicking links.
• Turn on two-factor authentication for email, social media and e-wallets.
• Verify unusual requests by calling the person or organisation using a number you already know.
• Keep your phone's operating system and apps updated.
• Talk to older family members about common scams. They are often targeted.

Scammers win when you rush. Whenever a message makes you feel panic or excitement, that is your signal to stop, hang up and verify.

What to do if you have been scammed

Speed matters. The sooner you act, the better the chance of stopping funds from moving further. According to the official National Scam Response Centre (NSRC) guidance, you should:

1. Call your bank's 24-hour hotline or the NSRC hotline at 997 immediately after noticing an unauthorised or unintended transaction.
2. Have your details ready: what happened, when, the scammer's account or phone number, and screenshots.
3. Lodge a police report at the nearest police station.
4. Change passwords for your banking, email and social media accounts, and uninstall any suspicious app.

The MyGovernment portal also lists the types of scams NSRC handles, including online shopping, investment, love and impersonation scams.

For small business owners

Businesses are targeted too, through fake supplier invoices, impersonated bosses asking for urgent transfers, and fraudulent orders. Set a rule that any change of bank details must be confirmed by phone. Our guide to fraud prevention for small stores covers how online sellers can spot suspicious orders. If your business uses connected devices, our IoT security checklist is worth a read too.

Teach the people around you

Share examples of scam messages in your family WhatsApp group so everyone recognises them. Agree on a simple rule: no one sends money because of a call or message without checking with another family member first.

Common scam scripts in Malaysia

Scams often follow familiar scripts. Some of the most frequent include fake parcel delivery messages asking for a small fee, calls claiming you owe money or are linked to a crime, fake job offers on social media, and online shopping deals that never arrive. Knowing these scripts makes it easier to recognise them when they reach your phone.

FAQ

What number do I call to report a scam in Malaysia?

Call the National Scam Response Centre at 997 or your bank's 24-hour hotline as soon as you notice an unauthorised transaction, then make a police report.

Will a bank ever ask for my OTP or TAC?

No. Banks do not ask customers to share OTPs, TACs, PINs or passwords. Anyone who asks is attempting a scam.

Can I get my money back after a scam?

Sometimes, if you report quickly enough for banks to intercept the funds, but there is no guarantee. That is why reporting immediately is so important.

Save 997 and your bank's hotline in your phone today, share this list with your family, and remember: stop, verify, and only then act.