Malaysians lost RM2.97 billion to online scams in 2025, according to Home Ministry figures given to Parliament. That's more than four times the yearly average of about RM660 million from 2017 to 2021, based on Bukit Aman's figures. Another RM830 million was lost from January to May 2026.
Bank Negara Malaysia (BNM) found that about 95% of online fraud cases were authorised transactions. In other words, the victims moved the money themselves after being tricked. Scammers' stories keep changing, but the same warning signs turn up again and again.
Key Takeaways
Never pay a fee to get a loan approved or released. That's how fake loan scams work, and no genuine lender asks you to pay into someone's personal account.
Hang up on anyone who says you're under investigation and asks you to move money "for safekeeping". The police, BNM and LHDN don't do this over the phone.
Check a bank account or phone number on Semak Mule before you transfer money to someone you don't know.
If you've been scammed, call 997 straight away. It runs 24 hours, and the sooner you call, the better the chance of freezing the money.
Ignore anyone offering a "RinggitPlus loan". RinggitPlus doesn't lend money or charge you to apply.
The Scams That Cost Malaysians The Most
Older scams mostly relied on a phone call. Today's scams also come through social media ads, WhatsApp and Telegram groups, and app files that take over your phone. Some use AI-made deepfake videos of well-known people, which the Securities Commission (SC) has warned about.
The Royal Malaysia Police (PDRM) recorded 67,735 online scam cases between January and November 2025, with losses of more than RM2.7 billion. Bernama reported the PDRM breakdown, showing which scams caused the most damage.
| Scam Type | Losses And Cases (Jan To Nov 2025) | Warning Sign |
| Fake investment schemes | RM1.37 billion, 9,296 cases | Guaranteed high returns on a platform you can't find on the SC's lists |
| Phone and impersonation scams | RM715.7 million, 28,698 cases | A caller says they're from the police, BNM, LHDN or a courier and tells you to move your money to a "safe" account |
| Fake bank sites and app files (e-finance fraud) | RM458.1 million, 5,853 cases | A link in an SMS that claims to be from your bank, or a request to install an app from outside the app store |
| Online shopping scams | RM123.7 million, 14,881 cases | A seller on social media asks you to pay by bank transfer outside the shopping platform |
| Fake loans | RM59.1 million, 8,029 cases | An "instant approval" loan that needs a fee before the money is released |
| Love scams | RM43.7 million, 978 cases | Someone you've never met in real life asks for money for an emergency or a customs fee |
Fake investment schemes had far fewer cases than phone scams but caused about half of all losses. Victims are often shown fake profits in an app, which persuades them to keep paying in. Job scams are another common type, and we cover them in How To Spot Job Scams And Pyramid Schemes.
Warning Signs That Almost Every Scam Shares
Run through this list whenever someone asks you for money or details:
- Someone you've never dealt with contacts you first, offering money, a job, a loan or a refund
- You're rushed, with an offer that ends today or a threat of arrest unless you act now
- You're told not to tell your family or your bank
- You have to pay first to receive something, like a loan, a parcel, a prize or your "profits"
- The payment goes to a personal bank account or e-wallet instead of a company account
- You're asked for your TAC, OTP, PIN or online banking password
- You're asked to install an app from a link, or to let someone control your phone remotely
- The returns are far higher than any bank offers, or approval is promised regardless of your credit record
If even one of these turns up, stop and check before you pay. According to Malaysia's bank associations, banks never ask for your card number and CVV, your online banking username and password, or an SMS OTP or TAC.
How To Check Someone Before You Pay
PDRM, BNM, the SC and KPKT run free tools to check whether a person, account or company has been flagged. Each takes a minute or two.
| What You're Checking | Where To Check | Run By |
| A bank account, phone number or company name you've been asked to pay | Semak Mule | PDRM |
| A company offering deposits, loans, forex or other financial services | Financial Consumer Alert List | BNM |
| An investment platform, adviser or digital asset exchange | Investor Alert List and the register of licence holders, or the list of registered digital asset exchanges for crypto exchanges | SC |
| A moneylender in Peninsular Malaysia | i-KrediKom app (Android or iOS) | Ministry of Housing and Local Government (KPKT) |
| Someone who says they work for RinggitPlus | RinggitPlus on WhatsApp, or email [email protected] | RinggitPlus |
Do note that a clean result doesn't prove someone is genuine. BNM says a company that's missing from its alert list shouldn't be taken as licensed. Scammers also open new bank accounts all the time, and a new one won't have been reported yet. If you're still unsure about a financial company, you can call BNMLINK at 1-300-88-5465 (Monday to Friday, 9am to 5pm).
If someone calls claiming to be from your bank, hang up and call the number on the back of your card or on the bank's official website. Never call back a number the caller gives you.
Mule Accounts And What Happens If You Rent Out Yours
Scammers need other people's bank accounts to move stolen money around, so they can't be traced. These are called mule accounts, or akaun keldai. Offers to rent your account often look like easy side income, such as "receive payments for our company and keep 10%". Sometimes it's a friend who says their own account has a transfer limit.
Letting someone else control your bank account or payment card without a lawful reason is an offence under Section 424B of the Penal Code, which took effect on 30 October 2024, according to the police. The penalty is at least a year in jail or a RM10,000 fine, and up to seven years, RM100,000 or both. If you move the money through your own account yourself, Section 424C carries three to ten years in jail, a fine of RM10,000 to RM150,000 or both. The offences cover ATM cards, credit cards, e-wallets and other payment methods.
Police officers of sergeant rank and above can also freeze money in an account they suspect is linked to a crime, under Section 116D of the Criminal Procedure Code. So even if you never touch the stolen money, the police can lock your own savings in that account. The freeze lasts up to 18 months if no one is charged. You can apply to the Sessions Court to change or lift it, for example so you can pay your living costs.
If you've already handed over your card or login, call your bank to block the account and change your passwords, then make a police report.
What To Do Straight After Being Scammed
Scammers move stolen money through several accounts within hours. The MyGOV portal asks victims to report within 24 hours of finding out so the authorities can still block accounts and transactions.
- Call your bank's fraud hotline and ask them to block your account, or use the kill switch in your banking app, which locks all online banking access.
- Call the National Scam Response Centre (NSRC) on 997. It's open 24 hours a day, and you don't need to make a separate police report first.
- Have the details ready when you call, including what happened in order, your bank account number, the account you paid into, the amounts and the transaction times.
- Keep every screenshot, receipt and chat. Don't delete the conversation, even if it's embarrassing.
- Change your online banking and email passwords, and uninstall any app the scammer asked you to download.
Do note that scammers also pose as NSRC officers. A nurse in Pahang lost RM88,700 to someone who said they were from the NSRC. If a caller says they're from the NSRC and asks you to move money, hang up and call 997 yourself.
How Banks Protect You From Online Scams explains when your bank has to compensate you. How To Escalate A Complaint Against Your Bank covers what to do if you disagree with its decision. For fraud on a credit card, see What To Do If Your Credit Card Is Used For Fraud.
Frequently Asked Questions
Can I get my money back after being scammed?
Sometimes, but most of the money is never returned. From 2022 to 2025, the NSRC seized RM25.2 million from scammers and returned RM7.3 million to victims, according to the Home Ministry. The Home Ministry's figures for 2022, 2023 and 2024 and 2025 add up to about RM6.7 billion lost to online scams over those four years. So through the NSRC, about RM1.10 came back for every RM1,000 lost. Calling 997 within 24 hours gives the best chance of freezing the money.
Your bank doesn't have to cover a transfer you made yourself. BNM's rules on compensating e-banking fraud victims cover transactions a scammer made without your knowledge. They exclude payments you approved, including love and investment scams.
How do I know a website is really RinggitPlus?
Check that the address in your browser is ringgitplus.com, spelt exactly like that. RinggitPlus never asks you to download an app file (.apk) to apply for a product, so a site that does is fake. If in doubt, close the page and type the address yourself.
