My mum got "the call" last month. A very polite "officer" from PDRM, case number and all, telling her that her IC had been used for money laundering and her accounts were about to be frozen. She was two steps from moving her savings to a "safe account" when my brother walked in and took the phone. She's sixty-eight and sharper than most of us. It nearly worked anyway.
Every scam that lands on a Malaysian phone — the officer, the parcel stuck at customs, the Telegram investment guru, the job that pays you for liking videos — is built from the same three parts: urgency, secrecy, and money or a password moving before you have time to think. Once you know the shape, the individual scripts stop mattering. So here's what's running right now, a three-question test that catches nearly all of it, and what to do in the first hour if one has already worked.
What Malaysians are actually getting
The Macau scam. A call from "PDRM", "LHDN", "Bank Negara", a court, or a courier company. Your identity has been used for money laundering, a parcel in your name has drugs in it, your account is about to be frozen. You get transferred to a "senior officer". Then comes the line: move your savings to a "safe account" for the investigation, and don't tell anyone. No agency in Malaysia asks you to move money over the phone. None. The second a caller mentions transferring money to "protect" it, it's this scam.
The phishing SMS. "Your TNG eWallet will expire", "your bank account is suspended", "your parcel needs an RM 3 redelivery fee", with a link. The link opens a page that looks exactly like the real app and asks you to log in. Real apps don't send you links to log in. Open the app yourself from your home screen and check there.
The APK scam. A Facebook ad for a cleaning service, a cheap grocery bundle, a tuition centre, a restaurant deal — and to order, you have to install "their app" from a file they send. That file is an APK that installs outside the Play Store, asks for accessibility permission, and then reads your banking app, your SMS and your OTPs. People wake up to empty accounts. This is the fastest-growing scam in the country right now. Never install an app from a file. Play Store or App Store only.
The investment guru. A Facebook or Telegram group, a confident host, screenshots of profit, a "mentor" who lets you withdraw a small early win so you believe it works. Then the bigger deposit, then the platform freezes, then a "tax" to release your money. Guaranteed returns don't exist. Bank Negara publishes a Financial Consumer Alert list of companies operating without a licence — if the name is on it, or isn't registered with the Securities Commission at all, there's nothing there to invest in.
The love scam. Weeks or months of daily messages from someone who can never quite meet in person. Then an emergency: a customs fee, a hospital bill, an investment "for our future". The relationship is the product. The emergency is the invoice.
The job scam. "Earn RM 300 a day liking videos and reviewing products." The first few small tasks really do pay. Then one task needs a deposit to "unlock the higher tier". Then another. Any job that makes you pay to work is not a job.
The mule account. "Rent me your bank account, I'll pay you RM 500 a month." The account gets used to receive scam money. Letting someone use your bank account is a crime in Malaysia, and the account holder is the first person the police come looking for.
The family emergency. "Hi Mum, this is my new number, my phone broke, I need RM 2,000 urgently." Call the old number. If it's really them, they'll pick up.
The three-question test
Before any money moves or any password gets typed, ask yourself:
- Is there urgency? A deadline, a threat, a window that's closing.
- Is there secrecy? "Don't tell your family", "don't inform the bank", "this line is confidential".
- Is money or a password moving somewhere new? A transfer to an account you've never used, a password, an OTP, a file to install.
Two out of three — it's a scam. Three out of three — it's a scam every single time. Real institutions can wait, never ask you to keep secrets, and never take payment into personal accounts.
Habits that shut the doors
- Hang up and call back on the number printed on your card or the agency's official website. Never on a number the caller gives you.
- Never tap a link in an SMS or chat to reach a bank, an e-wallet or a government service. Open the app or type the address.
- Never install an app from a file. On Android, keep "install unknown apps" switched off for every browser and messaging app.
- Check every unfamiliar account number on Semak Mule (semakmule.rmp.gov.my) before you transfer. It's the police list of accounts and numbers already reported in scams.
- Turn on your bank's protections. Lower your daily transfer limit to what you actually use. Switch on the kill switch so you can freeze your own account from the app. Use in-app approval instead of SMS OTP where the bank offers it.
- Tell one person before any big transfer. Scammers work by isolating you; a thirty-second call to a friend breaks the script.
- Set up a code word with your family for money requests, especially with older parents. Do it now, before it's needed.
Looking after the people around you
Older relatives get called more often, and they're more likely to believe a uniform on the phone. Save 997 in their contacts. Walk them through the Macau scam script once, so the words sound familiar when they hear them for real. Every few months, look through the apps on their phone and remove anything they can't explain. After what happened with my mum, we do this every Chinese New Year and every Raya. Takes ten minutes.
If it's already happened
Speed matters more than anything. Money sent to a mule account can often be frozen if the banks are told within hours.
- Call the National Scam Response Centre on 997 straight away (8am to 8pm daily). They contact the banks to freeze the funds.
- Call your bank's fraud line, and freeze your own account if you think your phone might be compromised.
- If you installed anything, switch the phone off, then factory-reset it before you touch banking again.
- Lodge a police report — any station, or online through the CCID portal. Freezes and recovery depend on it.
- Don't pay anyone who contacts you afterwards offering to recover the money. Recovery scams go after people who've just been scammed.
Why a casino is writing about this
Because the same people run the same scripts on our players: fake "agents" collecting deposits into personal accounts, copied login pages, "support" asking for OTPs. The three-question test protects a gaming account exactly the way it protects a savings account. Impulse88 shows deposit details only inside your logged-in account, never asks for a password or an OTP, and charges nothing to release a withdrawal. Anything that goes against that isn't us. See how the official site works.
