How to Report Scams and Financial Crime in Malaysia

The balance in your banking app suddenly drops, or you have just tapped “Confirm” on a transfer that now feels deeply wrong. Your heart races. In that moment, only one thing truly changes the outcome: not panic, but knowing which line to call — and calling it within the next few minutes, not tomorrow.

Online scams are no longer a minor problem in Malaysia. Losses reached RM2.97 billion in 2025, a surge of RM1.40 billion over the RM1.57 billion of the previous year, with 66,204 cases recorded — an 87% increase from 35,368 cases in 2024. These figures were announced by Inspector-General of Police Tan Sri Mohd Khalid Ismail on 15 June 2026. Non-existent investment schemes accounted for the largest losses at RM1.47 billion, while phone scams remained the most frequent with 28,388 cases. This guide explains what to do immediately after being scammed, how to check suspicious numbers, and how your report is actually processed.

What to do in the first hour?

The action flow is simple, and the order matters. Do things in parallel if you can — ask someone next to you to call the bank while you call 997.

1. Call 997 immediately if money has already been transferred. Do not wait to see whether it “went through” or “succeeded” first.
2. Contact your bank’s scam hotline at the same time. Bank lines operate 24/7 and the bank is the party that can technically hold back or freeze the transaction and the recipient account.
3. Do not look for a separate police report. From September 2025, a call to 997 itself counts as an official police report.
4. Keep all evidence. Transfer receipts, screenshots of conversations, the scammer’s phone number and account number — you will need them during the call.
5. Do not delete anything and do not contact the scammer again. Warning the scammer only speeds them up in withdrawing the money.

The 997 hotline is run by the National Scam Response Centre (NSRC), a joint operations centre that brings together the police, Bank Negara Malaysia, MCMC, financial institutions and telecommunications companies under one roof to respond quickly to online financial scams.

Which line for which situation?

Not every problem goes to 997. This table maps situations to the correct channel.

Situation	Channel	Who handles it
Money has already been transferred to a scammer, or you suspect so	997	National Scam Response Centre (NSRC) — PDRM, BNM, MCMC and banks working together
Suspicious transaction on your account; want to freeze card/account	Your bank’s scam hotline (24/7)	Your own bank
Life-threatening emergency — police, fire, ambulance	999 (112 can also be dialled from a mobile phone)	Malaysia Emergency Response Services (MERS 999)
Passing on commercial crime information or enquiries	013-211 1222 (CCID Infoline, WhatsApp/SMS only)	Commercial Crime Investigation Department (JSJK/CCID), PDRM
Checking an account or phone number before paying	semakmule.rmp.gov.my	JSJK/CCID, PDRM

Note the important distinction: 999 is not for financial scams — that is 997. Calling 999 for lost money only wastes precious time.

Why speed decides everything?

After money leaves your account, it usually moves quickly through a network of “mule accounts” before being withdrawn as cash or converted into other assets. As long as the money is still within the banking system and has not been withdrawn, there is a chance it can be held back or frozen.

That chance is highest in the first few hours. That is why a fast report is far more effective than a complete but late one. Contacting the bank at the same time as 997 is important because it is the bank that has direct control over the account — 997 coordinates, but the bank ultimately presses the freeze button.

For the same reason, “waiting a day to make sure” is a costly mistake. By tomorrow, the money is usually gone.

How is the report handled after you call 997?

A 997 call is not just about taking your details and hanging up. The NSRC functions as an operations room that coordinates several parties at once:

• Tracing and holding back the flow of money. Recipient account information is passed on to the banks involved to attempt to hold back or freeze the balance.
• Recording the report. Since September 2025, the call is recorded as a police report, and an investigating officer will be assigned to your case.
• Follow-up through the investigating officer. The 997 hotline is for emergency response, not status enquiries. Case updates are made through the assigned investigating officer, not by calling 997 again.

After the call, keep the reference number or report number you are given. You will need it for any follow-up, insurance claims, or enquiries with the bank.

How to check a suspicious account or phone number?

SemakMule (semakmule.rmp.gov.my) is a free public portal operated by the Commercial Crime Investigation Department (JSJK/CCID) of the PDRM. It lets anyone check whether a bank account number or phone number has been reported as involved in a commercial crime case.

Use this tool before you pay, not after. Example situations:

• A “seller” on social media gives you an account number to deposit for goods you have not yet seen — enter that number in SemakMule first.
• An overseas “employer” asks for a training or visa fee to be paid to a local account — check the account number and phone number.
• A call claiming to be from a bank or the authorities with a phone number you can check.

If the number is already flagged, that is a clear red flag. But remember: a number that is not flagged does not mean it is safe — it may be a new mule account that has not yet been reported. SemakMule confirms known dangers; it cannot confirm safety.

What information should you have ready before making a report?

The call goes more smoothly if you prepare these details in advance. Based on the official NSRC list:

• Chronology of events — what happened, from beginning to end.
• Your personal details — name, phone number, identity card number, and your own bank account number.
• Suspect information — name, phone number, and recipient account number.
• Transaction details — amount, date and time of each transfer.
• Transfer receipts or slips as evidence.
• URLs shared by the scammer.
• Communication evidence — screenshots of conversations, call logs, messages.

One important warning the authorities emphasise: the NSRC, police and banks will never ask for your username, password, PIN number, TAC or OTP. This is stated clearly on the official NSRC page at the NFCC. Anyone who asks for it — even if they claim to be from the scam response centre itself — is a scammer. You provide information about the case; you never hand over the keys to your account.

How does the CCID Infoline differ from 997?

For commercial crime information or enquiries that are not a “money just disappeared” emergency, the PDRM provides the CCID Infoline at 013-211 1222. This line has specific features you should understand:

• It operates only through SMS and WhatsApp — no voice calls are accepted.
• Operating hours are 8am to 12 midnight every day.
• It is for passing on information, complaints or enquiries related to commercial crime such as online scams, the Macau Scam, buy-and-sell scams, and non-existent loans.
• It accepts only registered Malaysian telecommunications numbers, and reports must be genuine, not a prank.

So the simple order is: 997 for the emergency of money in motion; bank for freezing; CCID Infoline for passing on information or enquiries; SemakMule for checking before you pay.

Decision framework: which channel for me?

Question	If YES	Channel
Has money already been transferred to a scammer?	Call immediately	997 + bank line
Is life in danger right now?	Call immediately	999 / 112
Want to check a number before paying?	Check first	semakmule.rmp.gov.my
Have commercial crime information/enquiries?	Send a message	013-211 1222
Lost documents, not money?	Make a report	Police station / PDRM e-Reporting

Common mistakes

• Waiting to “make sure first”. The window to freeze money is measured in hours, not days. Call first, arrange the evidence later.
• Calling 999 for a financial scam. That is not the channel — 997 is correct, and 999 is only for life-threatening emergencies.
• Assuming a separate report at a station is still mandatory. Since September 2025, a 997 call itself counts as a police report for that case.
• Handing over your OTP, TAC or password to anyone who calls, even if they claim to be helping to investigate your case.
• Paying first, checking later. SemakMule is useful before a transfer, not as a regret afterwards.
• Calling back a number given by the scammer to “confirm” — always use the official bank or agency number, not the number in that message.

Next steps

If the scam involves a QR or e-wallet transfer, DuitNow QR Payments explains how those transactions work and where disputes are taken. For a broader picture of Malaysia’s emergency numbers and the most common scam patterns, see 999, 997, and the First Hour After You Realise You Have Been Scammed. And if the bank is slow to act on a transaction you have raised, Opening a Bank Account explains the account relationship behind that scam hotline. Save the number 997, your bank’s scam hotline, and the SemakMule link in your phone now — before you need them.