# How to Report Scams and Financial Crime in Malaysia

> A step-by-step guide to acting in the first hour after being scammed — call the 997 hotline (National Scam Response Centre), use the CCID Infoline and SemakMule, and understand how your report is processed by the police and banks.

- Category: public-safety
- Language: en
- Status: published
- Updated: 2026-08-14
- Canonical: https://negaraku.md/en/public-safety/how-to-report-a-scam-malaysia

---

The balance in your banking app suddenly drops, or you have just tapped
"Confirm" on a transfer that now feels deeply wrong. Your heart races.
In that moment, only one thing truly changes the outcome: not panic, but
knowing which line to call — and calling it within the next few minutes,
not tomorrow.

Online scams are no longer a minor problem in Malaysia. Losses reached
**RM2.97 billion in 2025**, a surge of RM1.40 billion over the RM1.57
billion of the previous year, with **66,204 cases** recorded — an 87%
increase from 35,368 cases in 2024. These figures were announced by
Inspector-General of Police Tan Sri Mohd Khalid Ismail on 15 June 2026.
Non-existent investment schemes accounted for the largest losses at
RM1.47 billion, while phone scams remained the most frequent with 28,388
cases. This guide explains what to do immediately after being scammed,
how to check suspicious numbers, and how your report is actually
processed.

## What to do in the first hour?

The action flow is simple, and the order matters. Do things in parallel
if you can — ask someone next to you to call the bank while you call 997.

1. **Call 997 immediately** if money has already been transferred. Do not
   wait to see whether it "went through" or "succeeded" first.
2. **Contact your bank's scam hotline at the same time.** Bank lines
   operate 24/7 and the bank is the party that can technically hold back or
   freeze the transaction and the recipient account.
3. **Do not look for a separate police report.** From September 2025, a
   call to 997 itself counts as an official police report.
4. **Keep all evidence.** Transfer receipts, screenshots of conversations,
   the scammer's phone number and account number — you will need them
   during the call.
5. **Do not delete anything and do not contact the scammer again.**
   Warning the scammer only speeds them up in withdrawing the money.

The 997 hotline is run by the National Scam Response Centre (NSRC), a joint
operations centre that brings together the police, Bank Negara Malaysia,
MCMC, financial institutions and telecommunications companies under one
roof to respond quickly to online financial scams.

## Which line for which situation?

Not every problem goes to 997. This table maps situations to the correct
channel.

| Situation | Channel | Who handles it |
| --- | --- | --- |
| Money has already been transferred to a scammer, or you suspect so | **997** | National Scam Response Centre (NSRC) — PDRM, BNM, MCMC and banks working together |
| Suspicious transaction on your account; want to freeze card/account | **Your bank's scam hotline** (24/7) | Your own bank |
| Life-threatening emergency — police, fire, ambulance | **999** (**112** can also be dialled from a mobile phone) | Malaysia Emergency Response Services (MERS 999) |
| Passing on commercial crime information or enquiries | **013-211 1222** (CCID Infoline, WhatsApp/SMS only) | Commercial Crime Investigation Department (JSJK/CCID), PDRM |
| Checking an account or phone number before paying | **semakmule.rmp.gov.my** | JSJK/CCID, PDRM |

Note the important distinction: **999 is not for financial scams** — that
is 997. Calling 999 for lost money only wastes precious time.

## Why speed decides everything?

After money leaves your account, it usually moves quickly through a network
of "mule accounts" before being withdrawn as cash or converted into other
assets. As long as the money is still within the banking system and has not
been withdrawn, there is a chance it can be held back or frozen.

That chance is highest in the **first few hours**. That is why a fast
report is far more effective than a complete but late one. Contacting the
bank at the same time as 997 is important because it is the bank that has
direct control over the account — 997 coordinates, but the bank ultimately
presses the freeze button.

For the same reason, "waiting a day to make sure" is a costly mistake. By
tomorrow, the money is usually gone.

## How is the report handled after you call 997?

A 997 call is not just about taking your details and hanging up. The NSRC
functions as an operations room that coordinates several parties at once:

- **Tracing and holding back the flow of money.** Recipient account
  information is passed on to the banks involved to attempt to hold back or
  freeze the balance.
- **Recording the report.** Since September 2025, the call is recorded as a
  police report, and an investigating officer will be assigned to your case.
- **Follow-up through the investigating officer.** The 997 hotline is for
  emergency response, not status enquiries. Case updates are made through
  the assigned investigating officer, not by calling 997 again.

After the call, keep the reference number or report number you are given.
You will need it for any follow-up, insurance claims, or enquiries with the
bank.

## How to check a suspicious account or phone number?

SemakMule (semakmule.rmp.gov.my) is a free public portal operated by the
Commercial Crime Investigation Department (JSJK/CCID) of the PDRM. It lets
anyone check whether a **bank account number** or **phone number** has been
reported as involved in a commercial crime case.

Use this tool **before** you pay, not after. Example situations:

- A "seller" on social media gives you an account number to deposit for
  goods you have not yet seen — enter that number in SemakMule first.
- An overseas "employer" asks for a training or visa fee to be paid to a
  local account — check the account number and phone number.
- A call claiming to be from a bank or the authorities with a phone number
  you can check.

If the number is already flagged, that is a clear red flag. But remember: a
number that is *not* flagged does not mean it is safe — it may be a new mule
account that has not yet been reported. SemakMule confirms known dangers; it
cannot confirm safety.

## What information should you have ready before making a report?

The call goes more smoothly if you prepare these details in advance. Based
on the official NSRC list:

- **Chronology of events** — what happened, from beginning to end.
- **Your personal details** — name, phone number, identity card number, and
  your own bank account number.
- **Suspect information** — name, phone number, and recipient account
  number.
- **Transaction details** — amount, date and time of each transfer.
- **Transfer receipts or slips** as evidence.
- **URLs** shared by the scammer.
- **Communication evidence** — screenshots of conversations, call logs,
  messages.

One important warning the authorities emphasise: **the NSRC, police and
banks will never ask for your username, password, PIN number, TAC or OTP.**
This is stated clearly on the official NSRC page at the NFCC. Anyone who
asks for it — even if they claim to be from the scam response centre itself
— is a scammer. You provide information *about* the case; you never hand
over the keys to your account.

## How does the CCID Infoline differ from 997?

For commercial crime information or enquiries that are not a "money just
disappeared" emergency, the PDRM provides the **CCID Infoline** at
**013-211 1222**. This line has specific features you should understand:

- It operates **only through SMS and WhatsApp** — no voice calls are
  accepted.
- Operating hours are **8am to 12 midnight** every day.
- It is for passing on information, complaints or enquiries related to
  commercial crime such as online scams, the Macau Scam, buy-and-sell
  scams, and non-existent loans.
- It accepts only registered Malaysian telecommunications numbers, and
  reports must be genuine, not a prank.

So the simple order is: **997** for the emergency of money in motion;
**bank** for freezing; **CCID Infoline** for passing on information or
enquiries; **SemakMule** for checking before you pay.

## Decision framework: which channel for me?

| Question | If YES | Channel |
| --- | --- | --- |
| Has money already been transferred to a scammer? | Call immediately | 997 + bank line |
| Is life in danger right now? | Call immediately | 999 / 112 |
| Want to check a number before paying? | Check first | semakmule.rmp.gov.my |
| Have commercial crime information/enquiries? | Send a message | 013-211 1222 |
| Lost documents, not money? | Make a report | Police station / PDRM e-Reporting |

## Common mistakes

- **Waiting to "make sure first".** The window to freeze money is measured
  in hours, not days. Call first, arrange the evidence later.
- **Calling 999 for a financial scam.** That is not the channel — 997 is
  correct, and 999 is only for life-threatening emergencies.
- **Assuming a separate report at a station is still mandatory.** Since
  September 2025, a 997 call itself counts as a police report for that case.
- **Handing over your OTP, TAC or password** to anyone who calls, even if
  they claim to be helping to investigate your case.
- **Paying first, checking later.** SemakMule is useful before a transfer,
  not as a regret afterwards.
- **Calling back a number given by the scammer** to "confirm" — always use
  the official bank or agency number, not the number in that message.

## Next steps

If the scam involves a QR or e-wallet transfer, [DuitNow QR
Payments](/en/duitnow-qr-payments) explains how those transactions work and
where disputes are taken. For a broader picture of Malaysia's emergency
numbers and the most common scam patterns, see [999, 997, and the First
Hour After You Realise You Have Been
Scammed](/en/staying-safe-scams-and-emergencies). And if the bank is slow to
act on a transaction you have raised, [Opening a Bank
Account](/en/opening-bank-account) explains the account relationship behind
that scam hotline. Save the number 997, your bank's scam hotline, and the
SemakMule link in your phone now — before you need them.

## Sources

- National Scam Response Centre (NSRC) — https://nfcc.jpm.gov.my/index.php/en/about-nsrc (Pusat Kebangsaan Anti Jenayah Kewangan (NFCC), Jabatan Perdana Menteri)
- Hotline NSRC 997 — https://www.malaysia.gov.my/my/categories/keselamatan--komuniti/keselamatan-siber/hotline-nsrc-997 (MyGovernment (malaysia.gov.my), Jabatan Digital Negara)
- Calls to 997 scam hotline to be treated as police reports, says Deputy Comms Minister — https://www.thestar.com.my/news/nation/2025/07/26/calls-to-997-scam-hotline-to-be-treated-as-police-reports-says-deputy-comms-minister (The Star)
- Online scam cases surge 87% to 66,204 in 2025, says IGP — https://www.thestar.com.my/news/nation/2026/06/15/online-scam-cases-surge-87-to-66204-so-far-this-year-says-igp (The Star)
- Public Urged To Use 997 Hotline As 24-hour Scam Response Centre From September — https://www.bernama.com/en/news.php?id=2449632 (Bernama)
- PDRM perkenal platform CCID Infoline untuk orang ramai salur maklumat — https://www.bernama.com/bm/news.php?id=1717118 (Bernama)
- IGP: Online scam losses surge to RM2.97 bil in 2025 — https://theedgemalaysia.com/node/807010 (The Edge Malaysia)
- 997 Scam Hotline To Operate 24 Hours, Calls Treated As Police Reports From Sept — https://ringgitplus.com/en/blog/personal-finance-news/997-scam-hotline-to-operate-24-hours-calls-treated-as-police-reports-from-sept.html (RinggitPlus)
- CCID Portal — SemakMule (semak nombor akaun bank / nombor telefon) — https://semakmule.rmp.gov.my/ (Jabatan Siasatan Jenayah Komersial (JSJK/CCID), Polis Diraja Malaysia)
- Malaysia Emergency Response Services (MERS) 999 — https://www.malaysia.gov.my/en/my-initiative/cyber-security-and-disaster-response-and-recovery/tindak-balas-serta-pemulihan-bencana/malaysia-emergency-response-services-mers-999 (MyGovernment (malaysia.gov.my), Jabatan Digital Negara)
- e-Reporting — Laporan Polis Dalam Talian — https://ereporting.rmp.gov.my/index.aspx (Polis Diraja Malaysia (PDRM))

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0