When it happened to me — a "parcel" SMS, a link, a page that looked exactly like the courier's, RM 3 "redelivery fee" — I spent the first hour doing all the wrong things. Refreshing my banking app. Calling the scammer's number back (it rang out, obviously). Googling. By the time I called the bank, the money had already moved on from the mule account.
So let me say this first: getting scammed is not a sign you're stupid. These scripts are written by professionals, rehearsed on thousands of people, and timed for the exact moment your guard is down. What decides how much you get back isn't how it happened. It's what you do next, and in what order. This is that order — the first hour, the first day, the first week. Save it somewhere you can find in a panic.
The first hour
Money sent by bank transfer lands in a mule account and is usually withdrawn or moved on within hours. Everything in this section is about getting ahead of that.
1. Stop the bleeding. If you typed a password or an OTP anywhere, or installed a file someone sent you, assume the scammer is still inside. Freeze your bank account yourself — most Malaysian banking apps now have a kill switch (look for "freeze account" or "kill switch" in the app), or call the bank's 24-hour fraud line. If a file was installed, switch the phone off. Don't use it for banking again until it's been reset.
2. Call 997. That's the National Scam Response Centre, 8am to 8pm every day. They work with the banks and the telcos to freeze the money in the receiving account. Have these ready: your bank, the account number you paid into, the amount, the time, the transaction reference, and the phone number or link the scammer used. Outside those hours, go straight to the bank.
3. Call your bank's fraud line even if you've already called 997. Ask for three things: a hold or recall on the transfer, a block on any card involved, and a case reference number. Write that number down — every step after this will ask for it.
4. Screenshot everything, now. The chat, the profile, the ad, the group, the receipt, the URL, every phone number and bank account number. Scammers delete groups and profiles within hours of getting paid, and a police report with evidence is a very different thing from one without.
The first day
5. Make a police report. Any police station, or online through the CCID portal. Bring the screenshots and the bank receipt. That report number is what lets the bank keep the money frozen, and any return of money later depends on it. A freeze without a report can lapse.
6. Report the accounts and numbers. Submit the mule account number and the phone numbers through the CCID portal so they show up on Semak Mule for the next person who checks. Report the profile or ad to Facebook, Telegram or WhatsApp too. It won't bring your money back, but it cuts the scam's life short.
7. Clean the phone if you installed anything. Back up photos only, then factory-reset. Before the reset, look in Settings for any app with accessibility or SMS permissions you don't recognise — that's the thing that was reading your screen. After the reset, change every password from a different device, starting with your email, and turn on two-factor authentication on the email. Your email is the master key to everything else.
8. If a card was used, block it and ask for a new one. Card payments, unlike transfers, can sometimes be disputed as fraud through the bank that issued the card. Ask specifically for a chargeback and what the deadline is.
9. If you paid in crypto, note the transaction hash and the receiving address, and report both to the exchange you sent from. Exchanges can flag a destination address. Getting it back is rare, but the trail is permanent and reports do lead to freezes at the exchange level.
10. If you shared your IC or a selfie, tell your bank your identity may be misused, and check your credit report (CCRIS through Bank Negara, or CTOS) over the next few weeks for loans or accounts you didn't open.
The first week
11. Follow up on the freeze. Call the bank with your case reference and ask whether the money was held and what happens next. Frozen money doesn't come back automatically — it's held while the police investigate, and getting it back depends on the report staying active. This can take months. Keep calling.
12. Expect the second wave. Within days you may hear from a "recovery agent", a "lawyer", a "hacker" or a "police officer" who can get your money back for a fee, a tax, or a deposit. This is the same scam, aimed at people who just got scammed and are desperate. Nobody legitimate charges to recover scam losses, and the police never take payment. Block and report.
13. Tell someone. Shame is what scammers count on to keep reports low. I didn't tell my wife for three days, and those were three days she could have been watching for the second wave with me. Telling one person makes every next step easier.
What realistically comes back
Straight answer, so you put your effort where it works. A bank transfer reported within an hour or two has a real chance of being frozen before the mule account is emptied; after a day, that chance drops hard. A card payment can often be disputed. E-wallet transfers and cash handed over rarely come back. Crypto almost never does. That's why the first hour matters more than everything after it — and why paying anyone who "promises" recovery just adds a second loss to the first.
If it was a casino scam
If you deposited to a personal account given by a WhatsApp or Telegram "agent", send the number and the account to the real site's support — through the site itself, not through any chat. They can confirm the account was never theirs, blacklist the impersonator, and warn other players. If you logged in on a copied site, change your casino password and your email password, log out of all sessions, and check that the withdrawal bank details in your account haven't been changed.
At Impulse88, deposit details only appear on the deposit page after you log in, support never asks for a password or an OTP, and withdrawals only go to a bank account in your own name. Anything that contradicts that isn't us, and we want to know about it. Contact support through the official site.
The short version
- Freeze your account. Switch off a compromised phone.
- Call 997 (8am–8pm), then your bank's fraud line. Get a case reference.
- Screenshot everything before it disappears.
- Police report within the day. Report the account and numbers to CCID.
- Reset the phone if anything was installed. Change passwords from another device, email first.
- Follow up on the freeze every week.
- Pay nobody who promises to get the money back.
