Scamstats
Get updates

Malaysia

Population 36 million · Latest figures: 2025

Download Country Report PDF

Police recorded 66,204 online fraud cases in 2025, almost double the 35,368 of 2024, with losses of RM2.97 billion against RM1.57 billion. A further RM830 million was lost in the first five months of 2026.

The centre of the response is the National Scam Response Centre (NSRC), reached on 997. It was set up in October 2022 by the police, the central bank, the communications regulator and the National Anti-Financial Crime Centre, together with banks and telcos. The police took charge of it in July 2025, and in November 2025 it moved to Cyberjaya with police and bank staff in one room.

The law has been tightened in steps: mule account offences and a police power to freeze accounts (October 2024), licensing of large social media and messaging services (2025), the Online Safety Act, which makes financial fraud priority content that platforms must take down (January 2026), and a Cybercrimes Bill passed by both houses of Parliament in July 2026. On 18 June 2026 the government set up a committee of ministries, agencies, banks, telcos and major platforms to tackle online scams.

People scammed
1,546,081
5.8% of adults

Phone scams are the most common: callers pose as police, officials, banks or couriers. Investment syndicates find people on Facebook and Instagram and move them to WhatsApp or Telegram groups that promise quick, high returns: RM188 million was lost this way in the first two months of 2026. Job scams advertise part-time work on social media and messaging apps, then ask for payments in advance: losses reached RM202.58 million in 2025. Another route is a file sent by WhatsApp, often disguised as a wedding invitation, which installs an app that gives the scammer control of the phone.

Scam adverts are concentrated on a few platforms: of more than 127,000 scam items the communications regulator flagged between January and August 2026, 53% were on Facebook and 39% on TikTok. Scammers also use deepfakes: in 2024 police investigated 454 fraud cases involving deepfake technology. Private-sector workers are the largest group of victims, followed by government employees, students, business owners and retirees. Scam call centres also operate inside Malaysia: raids near Forest City in Johor in July 2026 arrested more than 330 people.

People who lost money
1,119,576
72% of victims

About 95% of online fraud cases are payments the victim made themselves, according to the central bank. The money goes into mule accounts, bank accounts rented or bought from their owners, and is moved on through several more. Police identified 173,224 mule accounts between 2022 and July 2025.

Since 2022 the central bank has required banks to drop SMS passcodes for transfers, tie online banking to a single device, impose a cooling-off period when a new device is enrolled, block suspicious transfers until the customer confirms them, and run dedicated scam hotlines. Every major bank also offers a kill switch that lets customers freeze their own accounts. Banks stopped about RM1.9 billion of attempted fraudulent transactions in the first half of 2026.

Telcos have blocked SMS containing links since 2023, and between 2022 and June 2026 blocked 2.5 billion suspicious calls and 3.04 billion SMS. Since February 2026 a person may hold at most five prepaid SIM cards with each provider.

Money lost
US$787.2m
RM3.37b in a year, 0.17% of GDP

Police recorded 66,204 online fraud cases in 2025 with losses of RM2.97 billion, almost double the 35,368 cases and RM1.57 billion of 2024, the Home Ministry told Parliament. In the first five months of 2026, 29,434 cases cost RM827.73 million. The count covers only cases reported to the police.

Investment scams cost the most: RM1.46 billion in 2025, about half of all losses, up from RM848.62 million in 2024. Phone scams cost RM802.47 million and love scams RM47.44 million. In police figures for January to November 2025, the 9,296 investment cases lost over RM1.37 billion, about RM147,000 each, while 14,881 e-commerce cases lost RM123.7 million, about RM8,300 each.

Job scams are growing: part-time job scams cost RM202.58 million in 2025, up from RM118.83 million in 2024. Selangor lost RM986.79 million and Kuala Lumpur RM782.86 million in 2025. In January to May 2026 investment scams cost RM361.63 million and phone scams RM235.63 million.

Money returned
US$45.7m
5.8% of the money lost

Bank refunds cover only unauthorised transactions. Under a central bank policy in force since 1 October 2024, a bank must check its own controls first when a customer loses money to malware or phishing, and pays in full where the loss came only from gaps in its security. Payments the victim made, as in investment and love scams, are outside it, and about 95% of online fraud cases are payments of that kind, according to the central bank. The number of victims paid in full or in part rose by about 26% in 2025. A customer who disagrees can go to the Financial Markets Ombudsman Service. In September 2026 the law minister said banks that receive scam money should share responsibility.

Money pulled back from scammers' accounts runs through the National Scam Response Centre (NSRC), where police, banks and telcos work together. Police can freeze a suspect account for up to 18 months, and any balance is returned to victims through legal procedure. In 2025 the centre seized RM17.49 million and returned RM6.65 million of it, 38%. In the first five months of 2026 it returned RM3.57 million of RM7.25 million seized, 49%, the Home Ministry told Parliament. Speed decides the outcome: police treat the first 24 hours as the golden hour.

Reported
55%
of victims reported it

In the Armidale 2026 survey, 41.4% of victims of the last 12 months told the police and 55.2% reported to some institution, such as the police, a bank or a platform. Police recorded 66,204 online fraud cases in 2025, almost double the 35,368 of 2024, and 29,434 more in the first five months of 2026. Those reports sit with the Commercial Crime Investigation Department.

The National Scam Response Centre, where police, bank and telco staff sit together, attended to 138,953 calls on online financial scams in 2025, 83,232 of them from people who had been scammed, around 500 a day, and opened 24,013 investigation papers. It can trace a payment through several accounts and have them blocked and frozen. Since the police took charge in July 2025 the government has said the call itself is treated as a police report. The National Fraud Portal, run with the banks, automates the handling of those reports across institutions.

Banks take reports on dedicated scam lines. The Securities Commission received 6,893 complaints and enquiries in 2025, up 22%: 61% of complaints and 70% of enquiries were about unlicensed activity and scams. CyberSecurity Malaysia's Cyber999 logged 7,616 incident reports in 2025, most of them fraud. The domestic trade ministry took 10,486 e-commerce complaints in 2024 and more than 4,800 by July 2025. The police Semak Mule database listed about 300,000 bank accounts and 234,000 phone numbers reported as mule accounts, and had been searched more than 26 million times.

Police records
66,204
cases recorded by the authorities

The police Commercial Crime Investigation Department counts cases in which an investigation paper is opened. For January to November 2025 it gave them by type: phone scams 28,698 cases and RM715.7 million lost, e-commerce fraud 14,881 cases and RM123.7 million, fake investments 9,296 cases and more than RM1.37 billion, non-existent loans 8,029 cases and RM59.1 million, e-finance fraud 5,853 cases and RM458.1 million, and love scams 978 cases and RM43.7 million. Scams reported only to a bank, and scams never reported, are not in these counts.

Enforcement is aimed at mule accounts. Penal Code sections 424A to 424D, in force since 30 October 2024, make it an offence to control another person's bank account or to hand over one's own, with up to seven years in prison for giving an account away. The central bank counted 969 convictions of mule account holders in 2025. Two police operations in September 2025 arrested 2,123 suspects. In September 2026 the Inspector-General of Police proposed heavier sentences for scammers, including caning.

Victims who told the police (estimated)
639,758
Cases recorded by the authorities
66,204
Most common
  1. Online shopping
  2. Government impersonation
  3. Jobs
  4. Prizes

By number of cases, phone scams are far ahead: 28,388 in 2025, more than four in ten of all online fraud cases. A caller claims to be from the police, a government office, a bank or a courier, and says the victim is tied to a crime or a debt.

By money, fake investment schemes cost the most: RM1.46 billion in 2025, about half of all losses, against RM802 million for phone scams. Victims are drawn in by adverts on Facebook and Instagram and moved into chat groups that promise quick returns.

Online shopping fraud is the second most common type but costs far less per case. Loan scams take fees in advance for loans that do not exist, and job scams ask for deposits before paying a promised commission. Love scams are few, under 1,000 cases a year, but cost RM47 million in 2025.

Government response

Malaysia's main programme is the National Scam Response Centre, where police, the central bank, the communications regulator, banks and telcos work in one room to trace and freeze stolen money. Behind it, a National Fraud Portal run with the payments network lets banks share fraud reports and trace funds across institutions automatically, and the central bank has imposed the same security measures on every bank. On blocking, the results are large: banks stopped about RM1.9 billion of attempted fraud in the first half of 2026, and telcos have blocked billions of calls and messages.

On outcomes they are weak. Recorded cases almost doubled in 2025 and losses rose to RM2.97 billion. Of the money seized between 2022 and 2025, 29% went back to victims.

Cooperation is strongest among banks, which the central bank can direct, and weakest with platforms: more than half of the scam content the regulator flagged in 2026 was on Facebook, and each takedown request takes its staff 30 to 45 minutes. No rule makes banks, telcos or platforms pay when a victim is tricked into making a payment. The law minister raised it in September 2026, and the central bank says Malaysia may consider bringing telcos and platforms into compensation. The Online Safety Act, in force since January 2026, is the first law to put deadlines on platforms. The committee formed in June 2026 to bring ministries, banks, telcos and platforms together had not yet reported to Cabinet in September 2026.

Get updates on Malaysia

An email when we update these figures. Add more countries, or follow them all.

Calculation Methodology & Sources

People scammed

From one survey:

  • 5.8%: Armidale, ASEAN Consumer Scam Report 2026 for the GSMA (figures computed from the respondent data), Respondent data, Q25 (12 months to 3 August 2026).
  • 5.8% of 26,656,575 adults.

People who lost money

From one survey:

  • 72.4%: Armidale, ASEAN Consumer Scam Report 2026 for the GSMA (figures computed from the respondent data), Respondent data, Q32 (12 months to 3 August 2026).

Money lost

  • RM2.97b was lost in cases recorded by the authorities. Adding the 1,053,372 victims who lost money but are not in those records, at RM382 each, gives RM3.37b.
  • Price of an unrecorded loss: Read off the line fitted to GDP per person in the countries where this price is measured (Canada, Chile, Mexico, Singapore and United States): US$89.26 = MYR 382.43.
  • US dollars at 0.233403595 per MYR.
  • Share of GDP: US$787.2m against GDP of US$472.19b in 2025. World Bank, GDP (current US$) 2025.

Money returned

  • Vanguardia, reporting CONDUSEF, Crece la estafa digital: más de 2.4 millones de fraudes bancarios en México durante 2025, Level average, see note.
  • No national figure covers every route, so the average is used for countries where the rules make banks refund only part of fraud losses. Worked out: banks return 11.4% of money lost through banks, the average of Russia and Mexico; banks returned MYR 165.1m (11.4% of the 42.9% of money lost through banks); MYR 30.8m came back on money lost outside banks (1.6%, from Armidale's non-government survey of seven Asian markets, converted to money).
  • 5.8% of RM3.37b lost.

Reported

From one survey:

  • 55.2%: Armidale, ASEAN Consumer Scam Report 2026 for the GSMA (figures computed from the respondent data), Respondent data, Q33 (12 months to 3 August 2026).

Police records

  • 41.4%: Armidale, ASEAN Consumer Scam Report 2026 for the GSMA (figures computed from the respondent data), Respondent data, Q33 (12 months to 3 August 2026).
  • 66,204: Online fraud cases recorded by the Royal Malaysia Police, including hacking and phishing.

Most common

  • Ranked by scam types that affected victims of the last 12 months most (Armidale 2026; victims could choose more than one). 31.8% of answers are methods such as phishing, or other, and are not ranked.

Sources

  • Allen & Gledhill (Rahmat Lim & Partners), Cybercrimes Bill 2026: closing the gaps in Malaysia's cybercrime legal framework (6 August 2026). Industry source. A law firm summary of the Cybercrimes Bill 2026. Original
  • Armidale, ASEAN Consumer Scam Report 2026 for the GSMA (figures computed from the respondent data) (4 September 2026). Survey. Online survey of adults aged 18 and over in each country (Milieu Insight panel). Original
  • Bernama, Hasil Jawatankuasa Kerja Tangani Scam Dibawa Ke Kabinet Dalam Masa Terdekat - Fahmi (10 September 2026). News report. Reports the progress of the anti-scam committee. Original
  • Bernama, Trend Kerugian Penipuan Dalam Talian Melonjak Dalam Tempoh Tiga Tahun - KDN (24 June 2026). News report. Reports a written parliamentary answer by the Home Ministry. Original
  • Bernama, More Than 127,000 Scam Contents From Social Media Platforms Detected By MCMC Since January - Fahmi (19 August 2026). News report. Reports the communications regulator's figures. Original
  • Bernama, PM Anwar Launches 24-hour NSRC At MCMC Tower 2 (3 March 2026). News report. Reports the launch of the National Scam Response Centre at its new premises. Original
  • Bernama, Police Record 28,377 Commercial Crime Cases With Losses Of Over RM2.5 Billion As Of Nov 24 (27 November 2024). News report. Reports a statement by the commercial crime police. Original
  • Bernama, MCMC: large social media and messaging services deemed licensed from 1 January 2026 (15 December 2025). News report. Reports the communications regulator's announcement. Original
  • Bernama, MCMC Introduces Mandatory Standard To Tighten Prepaid Sim Card Registration (26 February 2026). News report. Reports the communications regulator's rules. Original
  • Bernama, Police: Online Scams Cost Malaysians Over RM2.7 Billion As Of November (8 December 2025). News report. Reports police statistics. Original
  • Bank Negara Malaysia, Annual Report 2025 (Diagram 4, National Scam Response Centre key outcomes in 2025) (30 March 2026). Official source. Reports the National Scam Response Centre's own figures. Original · Archived copy
  • Bank Negara Malaysia, Annual Report 2025: box article on fair treatment of victims of online banking fraud (1 March 2026). Official source. The central bank's account of its own policy. Original · Archived copy
  • Bank Negara Malaysia, Annual Report 2025: Maintaining Financial Integrity (1 March 2026). Official source. The central bank's account of its own and the police's work. Original · Archived copy
  • Bank Negara Malaysia, Policy Document on Ensuring Fair Treatment for Victims of Unauthorised e-Banking Transactions (28 June 2024). Official source. Describes the central bank's own policy. Original · Archived copy
  • Bank Negara Malaysia, Governor's Opening Address at the International Conference on Financial Crime and Terrorism Financing (IFCTF) 2023 (3 October 2023). Official source. Describes the central bank's own measures. Original · Archived copy
  • Bank Negara Malaysia, Governor's Speech at the Launching of Financial Crime Exhibition (26 September 2022). Official source. Describes the central bank's own measures. Original · Archived copy
  • Bank Negara Malaysia, National Fraud Portal to solidify coordinated efforts in curbing financial scams (20 August 2024). Official source. Describes the central bank's own platform. Original · Archived copy
  • Free Malaysia Today, Cops can now freeze, seize mule bank accounts (18 November 2024). News report. Reports a statement by the deputy law minister. Original
  • Harian Metro, Aduan berkaitan e-Dagang paling tinggi diterima KPDN (23 August 2025). News report. Reports the domestic trade ministry's complaint counts. Original
  • Kementerian Dalam Negeri (Ministry of Home Affairs), Oral answer to question 29, Dewan Rakyat, 14 July 2026, citing Commercial Crime Investigation Department statistics (14 July 2026). Official source. Describes the police's own enforcement results. Original · Archived copy
  • Kementerian Dalam Negeri (Ministry of Home Affairs), Written answer to question 392, Dewan Rakyat (Jawapan Bertulis 22 June to 16 July 2026), citing Royal Malaysia Police statistics (16 July 2026). Official source. Counts only investigation papers opened by the police for online crime; scams reported only to banks or the National Scam Response Centre and scams never reported are not included. Original · Archived copy
  • Kosmo, 26.5 juta carian dilakukan di portal Semak Mule sejak 2020 (30 October 2025). News report. Reports figures given by the commercial crime police. Original
  • Malay Mail, AI scams are getting real: Here are the cases happening in Malaysia that you should know about (4 August 2025). News report. Reports police figures. Original
  • Maxis, FAQ: SMS Content Blocking Requirements. Industry source. A telco's account of the regulator's directive. Original
  • Mayer Brown, Short Deadlines, Significant Penalties: Malaysia's Online Safety Act in Focus (3 July 2026). Industry source. A law firm summary of the Online Safety Act 2025. Original
  • CyberSecurity Malaysia (MyCERT), Hari Raya Holiday Cyber Security Best Practices (Cyber999 incident totals for 2025) (19 March 2026). Official source. The national computer emergency response team's own incident reports. Original · Archived copy
  • New Straits Times, BNM: Banks will bear fraud losses due to lapses in security (25 December 2024). News report. Reports the central bank's policy. Original
  • New Straits Times, IGP: 66,204 online scam cases reported in 2025 (16 June 2026). News report. Reports police statistics given by the Inspector-General of Police. Original
  • New Straits Times, Police proposes heavier sentences, rotan for online scammers (7 September 2026). News report. Reports a statement by the Inspector-General of Police. Original
  • New Straits Times (Bernama), Police: Losses from investment scams hit RM1.47 bln last year (18 April 2026). News report. Reports a police briefing. Original
  • New Straits Times, Gone in a month: RM188 million lost to scams (23 March 2026). News report. Reports police statistics. Original
  • New Straits Times, Scam hotline now under police as cases spike nationwide (16 July 2025). News report. Reports a statement by the Home Minister. Original
  • RTM, 'Golden Hour' penentu nasib mangsa penipuan dalam talian (26 February 2026). News report. Reports a statement by the commercial crime police. Original
  • RTM, NSRC diterajui PDRM, perkukuh tindak balas penipuan dalam talian (16 July 2025). News report. Reports a statement by the Home Minister. Original
  • RTM, Jenayah kewangan: 173,224 akaun keldai dibongkar, portal Semak Mule jadi rujukan (26 August 2025). News report. Reports an answer in the Dewan Negara. Original
  • SAYS, PDRM Advises M'sians To Be Cautious Of .APK Files Disguised As Wedding Invitations (4 June 2024). News report. Reports a police warning. Original
  • Securities Commission Malaysia, Annual Report 2025: Complaints and Enquiries (22 April 2026). Official source. The regulator's own complaint and enquiry counts. Original · Archived copy
  • Sinar Harian, Kes tipu tawaran kerja sambilan meningkat 146 peratus, nilai kerugian lebih RM200 juta (19 December 2025). News report. Reports a statement by the commercial crime police. Original
  • The Star, Azalina backs heavier penalties for scammers, calls for greater bank accountability (8 September 2026). News report. Reports a statement by the law minister. Original
  • The Star, Over 330 scammers arrested (28 July 2026). News report. Reports police raids. Original
  • The Star, Crackdown on online frauds (31 October 2025). News report. Reports police operations. Original
  • theSun, New task force to tackle rising online scams in Malaysia (2 July 2026). News report. Reports a government announcement. Original
  • The Vibes, Over 3 billion suspicious SMS, 2.5 billion fraudulent calls blocked by MCMC (21 July 2026). News report. Reports the communications regulator's figures. Original
  • The Vibes, Malaysia prevents RM1.9b in scam transactions as BNM targets real-time fraud alerts (6 October 2026). News report. Reports a statement by the central bank governor. Original
  • The Vibes, RM6.7 million recovered for scam victims as mule account crackdown intensifies (27 January 2026). News report. Reports a parliamentary answer by the Home Minister. Original
  • UN DESA, World Population Prospects 2024 (medium variant) (11 July 2024). Official source. Modelled estimates built from censuses and surveys. Original · Archived copy
  • Vanguardia, reporting CONDUSEF, Crece la estafa digital: más de 2.4 millones de fraudes bancarios en México durante 2025 (1 August 2025). News report. Press report of CONDUSEF figures on fraud claims and refunds. Original · Archived copy
  • World Bank, Official exchange rate (local currency units per US$, period average) 2025 (8 October 2026). Official source. Annual average of official exchange rates reported by national authorities. Original · Archived copy
  • World Bank, GDP (current US$) 2025 (8 October 2026). Official source. National accounts estimates that are revised as countries report. Original · Archived copy

scamstats.org/country/my/ · Scamstats is an initiative of Armidale · data licensed CC BY 4.0