Just got scammed? You have about 60 minutes. Here's exactly what to do.

If you have just transferred money to a scammer, stop reading and call 997 now. That's the National Scam Response Centre. The first hour after a transfer is your best chance of the money being frozen before it moves through the layers. Come back to this page afterwards.

Everyone else: here's what you're up against.

Malaysians lost RM5.37 billion to online scams between 2024 and May 2026. Telecommunications scams — the Macau scam family — accounted for RM1.54 billion of that. Annual losses nearly doubled from RM1.57 billion in 2024 to RM2.97 billion in 2025, and the first five months of 2026 alone took another RM830 million.

For scale: that's more than the annual budget of several government ministries, being wired out of the country by people on the phone.

1. How the call actually goes

The structure is consistent because it works.

The hook. An automated call or a live caller: a parcel in your name has been seized, your bank account is linked to money laundering, you have an unpaid LHDN assessment, there's a warrant with your name on it. Sometimes they'll have your name and IC number already, which is what makes it land.

The transfer. You get passed to a "police officer" or "Bank Negara officer". Sometimes a video call with a man in uniform in front of a police-looking backdrop. They may quote a real-sounding report number, or send you a document with a real-looking letterhead.

The isolation. This is the part that does the damage. You are told the investigation is confidential. You must not tell your family. You must not go to the police station because officers there may be implicated. Stay on the line. Don't hang up.

The squeeze. To "clear your name" or "verify the funds are clean", transfer your money to a designated account. Sometimes they'll ask you to move it in stages, or to withdraw cash and deposit it into a specific machine.

The follow-up. Once you've paid, there's often more — tax on the release, a processing fee, a clearance charge. Each payment triggers another.

The single fact that defeats all of it: real Malaysian authorities never ask for money transfers over the phone. Not PDRM, not Bank Negara, not LHDN, not the courts. No genuine investigation requires you to move your savings anywhere, and no genuine officer will tell you to keep it from your family.

2. What's changed: AI voices

The version that's growing is harder to spot.

AI-powered scams including deepfakes and voice cloning accounted for over 450 cases in 2025, with RM2.72 million in losses. A deepfake video of Johor's Sultan Ibrahim Iskandar circulated. Victims included a KL resident defrauded of RM3,000 and a Penang housewife who lost RM4,800.

The scam that hurts most is the family version: a call that sounds like your son, your daughter, your mother, in trouble and needing money now.

You cannot reliably tell by ear. That's the whole point of the technology. The defence has to be behavioural, not auditory:

• Hang up and call back on a number you already have saved. Not a number they give you.
• Ask something only they would know — not a birthday or anything on Facebook. Something small and domestic.
• Treat urgency plus a money request as the tell, regardless of how convincing the voice is.

Agree a family code word now, while nothing is happening. It sounds paranoid until the day it isn't.

3. What to do in the first hour

This is the operational core of the page.

Call 997 — the National Scam Response Centre. It's a joint operation of PDRM, Bank Negara, MCMC and the major banks, and it can trigger an immediate freeze request on the recipient account. As of 2026 it runs 24/7, and the call itself is treated as an official police report — you don't need to make a separate one at a station first.

Have ready:

• Your bank account number
• The amount transferred
• The recipient account number
• Exact time of transfer
• Transaction reference
• A brief summary of what happened

Speed is everything, and the numbers show why. Since NSRC was set up in 2022, RM32.49 million in victim funds has been seized and RM10.9 million returned. In the January–May 2026 period, RM7.25 million was seized with RM3.57 million (49%) returned — up from 29% in the 2022–2025 period.

But be realistic about the odds. In 2025, of RM542 million in reported scam losses, agencies recovered around RM34 million — roughly 6%. Recovery happens when the money is intercepted before it moves through multiple layers of accounts. That window is short.

Then:

• Call your bank's fraud line as well, and ask them to log it
• Check the recipient account on Semak Mule (semakmule.rmp.gov.my) — PDRM's free public lookup for bank accounts, phone numbers and identities reported in fraud. No login needed.
• Preserve everything: call logs, screenshots, the numbers used, any documents they sent, transaction records
• Tell your family. The shame is the scammer's most useful tool, and it delays the call that matters.

Use Semak Mule before transferring to any account you don't know. It takes thirty seconds and it's free.

4. The trap on the other side: mule accounts

This is the part most articles miss, and it's where ordinary people become defendants.

In October 2024, the Penal Code (Amendment) Act 2024 introduced four new provisions targeting mule account conduct:

• Section 424A — possessing or controlling another person's bank account or payment instrument without lawful authority. Fine RM5,000–RM50,000, jail six months to five years, or both.
• Section 424B — giving someone else control of your account without lawful authority. Fine RM10,000–RM100,000, jail one to seven years, or both.
• Section 424C — the unlawful transactions themselves, using your own or someone else's account. Fine RM10,000–RM150,000, jail three to ten years, or both.

Police of sergeant rank and above can now freeze accounts and prevent withdrawals directly.

Why this matters to you even if you'd never help a scammer. The typical Malaysian keldai (mule) isn't a criminal — they're someone who:

• Took a "job" that involved receiving and forwarding payments
• Let a friend or relative "borrow" their account temporarily
• Was told by an online boyfriend or girlfriend to receive a transfer
• Opened an account for someone who said they had credit problems
• Handed over online banking credentials to someone who seemed legitimate

Once scam funds pass through your account, you are on the police radar even if you never touched the money. The question becomes whether your account was used in a scam transaction — and you'll be explaining yourself under provisions carrying years of imprisonment.

The rule is absolute: never let anyone use your bank account, and never accept a job that involves receiving and forwarding money. There is no legitimate employer in Malaysia who needs your personal account to process their payments.

5. Don't get scammed twice

After the first loss comes the recovery scam.

Someone contacts you — often on WhatsApp or Facebook — offering to recover your money for a fee. They may impersonate NSRC or NFCC, wave fabricated appointment letters, and ask for payment split across several accounts. PDRM has warned about this repeatedly.

No legitimate agency charges an upfront fee to recover scammed money. Not NSRC, not PDRM, not Bank Negara, not the SC. None of them will cold-call or WhatsApp you selling a recovery service.

If someone contacts you offering to get your money back for a payment, that is the second scam, and paying it is how people who lost RM50,000 end up losing RM70,000.

What to actually do

If it's happening right now:

• Hang up. You owe an unsolicited caller nothing.
• Call the organisation back on a number you looked up yourself — not one they gave you.
• Tell someone in your family immediately. Isolation is the mechanism.

If you've already paid:

• 997, immediately. Minutes matter.
• Bank fraud line.
• Preserve all evidence.
• Check the account on Semak Mule.
• Tell your family — you'll need them, and they may be targets next.

To protect yourself and your parents:

• Agree a family code word for emergency money requests.
• Tell elderly relatives plainly: no Malaysian government agency will ever phone and ask them to transfer money, and it is always safe to hang up and call back.
• Never give anyone access to your bank account. Never.
• Check unfamiliar accounts on Semak Mule before transferring.