Just lost money? Call the National Scam Response Centre on 997 and your bank's fraud line, now. Never share an OTP or approve a transfer after a call you didn't expect.

Independent fraud intelligence · Malaysia

See the scam before it reaches you.

Plain-language warnings on the scams hitting Malaysians and Malaysian businesses — and clear steps for the first hour if one already has.

Check something suspicious Read the advisories

Active advisory ADV-2026-04 · Updated Oct 2026

Fake apps that take over your phone and read your bank codes

Android APK files sent over WhatsApp, SMS or social media install malware that overlays your banking app and intercepts OTPs.

01Never install an app from a link or file someone sends you.
02Only download apps from Google Play or the App Store.
03Already installed one? Switch on flight mode and call your bank.

Read the full advisory

For everyone Is this a scam? A call, a message, a link or an investment offer you're unsure about. Four signs to check first. Act now I've been scammed What to do in the first hour, in order — who to call and what to keep. For banks & businesses Typologies & advisories Fraud patterns, controls and red flags for risk, fraud and compliance teams.

Advisories & case studies

What we're tracking

Each advisory opens with a plain summary for the public, then the typology, red flags and controls for professionals.

ADV-2026-04 Critical alert

Android APK malware & mobile overlay attacks

Fake apps sent over WhatsApp or SMS take over your phone and read your banking OTPs. Mobile banking malware · RASP

Public · Banks Full write-up soon

ADV-2026-05 High priority

Authorised push payment fraud on instant rails

You are talked into sending the money yourself — by DuitNow or transfer — to someone posing as a bank, courier or official. APP fraud · Social engineering · DuitNow

Public · Banks

ADV-2026-06 Emerging threat

C-suite impersonation via deepfake audio cloning

A cloned voice of a director calls finance staff to approve an urgent payment. Generative AI · Corporate fraud · Vishing

Business Full write-up soon

ADV-2026-02 Emerging threat

Business email compromise targeting SMEs

Look-alike emails from “suppliers” change the bank details on real invoices. SME vulnerability · BEC · Vendor fraud

Business Full write-up soon

ADV-2026-03 Regulatory alert

Mule account networks on instant payment rails

Accounts are rented or recruited to move stolen money. Lending yours is an offence. Digital payments · Mule accounts · AML

Public · Banks Full write-up soon

ADV-2026-01 High priority

First-party fraud & synthetic identity in retail credit

Made-up or blended identities pass eKYC to take credit that is never repaid. Synthetic identity · Credit risk · eKYC

Banks Full write-up soon

Is it a scam?

If you see any of these, stop.

Hang up, don't click, don't pay. A real bank, police officer or government agency will never mind you calling them back on a number you found yourself.

1 Urgency "Your account will be frozen today." "A warrant is out for you." Pressure to act now is the scam.

2 Secrecy Told not to tell your family, your bank or anyone else. Scammers isolate you so nobody can stop it.

3 Odd payments Asked to move money to a "safe account", a personal account, or to pay in crypto or gift cards.

4 Links & app files An unexpected link, QR code or .apk file to "verify", "claim" or "update". Don't open it.

I've been scammed

The first hour matters most.

The faster a transfer is reported, the better the chance it can be traced and held. Do these in order. It is not your fault — scams are run by organised groups.

Call NSRC 997National Scam Response Centre

01
Freeze your accountUse the Kill Switch in your banking app to block further transactions.
02
Call NSRC on 997They coordinate with banks to trace and hold the funds. The line is open 24 hours, every day.
03
Call your bank's 24/7 fraud lineUse the number on the back of your card or in the official app — never one the caller gave you.
04
Keep evidence, make a police reportScreenshot chats, numbers, account details and receipts, then lodge a report at any police station or online.

Check before you pay

Official checkers, in one place

PDRM · CCID SemakMule Check a bank account or phone number against reported scam accounts before you transfer. Open checker Bank Negara Malaysia Financial Consumer Alert List Companies and websites that are not authorised or approved by BNM. Open checker Securities Commission Investor Alert List Unlicensed investment schemes, platforms and individuals to avoid. Open checker VirusTotal URL & file scan Paste a suspicious link to see whether security vendors flag it. Open checker

Report a scam

Seen a new trick? Tell us how it works.

We use reports to spot new scam patterns early and warn others. Describe how it happened — leave out names, IC numbers and account numbers.

This is not a police report and won't recover money. If you've lost funds, follow the first-hour steps above first.

From the editor

FraudWatch Malaysia is an independent effort to turn public scam reports and fraud know-how into warnings people can act on — before the money moves.

It is non-commercial: no ads, no sponsors, nothing for sale. Content comes only from public sources and what readers report. Editorial & independence

FraudWatch AdminAnonymous fraud enthusiast and industry practitioner

The monthly brief

New scam patterns, once a month. Nothing else.

Unsubscribe any time. We never share your email.