Malaysia has one number worth memorising and a 24-hour clock attached to it, plus a check-before-you-pay service that is genuinely one of the best in the region. It also has a widely-recommended website that is not the official one, so start with that.
997, within 24 hours — and the gap in the hours
The National Scam Response Centre is 997, and if money has moved, it is the only route with a chance of stopping it. Bank Negara states the condition plainly: the call must be made within 24 hours of the incident, and within operating hours, which are 8am to 8pm daily including weekends and public holidays.
Read those two sentences together and you find the gap. A scam at nine on a Friday night cannot reach 997 until Saturday morning. In that window, call your own bank’s 24-hour fraud line immediately — every Malaysian bank has one — and call 997 when it opens.
A warning about searching: nsrc.my is not the National Scam Response Centre. It is a privately run site that says so itself. The centre has no standalone website; it is reached by phone, and the official description of it sits on Bank Negara’s and the national financial crime centre’s own pages.
Semak Mule, before you pay anyone
semakmule.rmp.gov.my, run by the police commercial crime department, lets you check a bank account number, a phone number or a company against accounts already reported for fraud. Use it before paying any stranger — a marketplace seller, a deposit, an “agent”.
Two caveats. A clean result does not mean safe; it means not yet reported. And the site currently serves a mismatched certificate chain, so your browser may warn you even though the certificate itself is genuinely the police’s. Do not let that train you into clicking through warnings elsewhere.
The police report
The commercial crime investigation department takes reports through ccid.rmp.gov.my and on 03-2610 1222. The report gives you a case number, which your bank will ask for. Run the receiving account through Semak Mule first and screenshot the result to attach.
Calls, texts and content: MCMC
Scam calls, SMS and online content go to aduan.mcmc.gov.my or 1800-188-030. If you have seen a complaint link on the regulator’s main site, it no longer works; the portal above is the live one. MCMC can block a number and order content taken down. It cannot recover money.
If the bank is the problem
Complain to your bank first and give it 14 calendar days. Only then does Bank Negara’s contact centre, BNMLINK on 1300-88-5465, take the matter — and what it regulates is your bank’s conduct, not the scammer. For a binding decision against a financial provider, the Financial Markets Ombudsman Service is free; it took over from the two older schemes at the start of 2025, and some official pages still link the old one.
On refunds, be realistic: Malaysia has no verified statutory right to reimbursement for a scam payment you authorised. Kill switches and cooling-off periods exist as features individual banks offer, not as a guarantee you can claim.
Two things to check before you believe a name
The Securities Commission’s investor alert list and Bank Negara’s financial consumer alert list both now flag “potential clone entities” — operations that copy the name, logo and licence number of a genuine firm. Recognising the brand proves nothing. Check the entity itself on the list.
The Macau Scam, and the trap after it
The recurring pattern: a caller claims to be from the police, Bank Negara, the tax office, a court or a courier, tells you your name is tied to money laundering, and instructs you to move your money to a “safe account”. No Malaysian agency ever asks you to transfer money to clear your name.
The second trap catches people who received scam money and passed it on. Their own account gets frozen and their name flagged as a mule. Bank Negara does not intervene in those decisions and keeps no blacklist — the appeal is to the bank, at its discretion. If money you did not expect lands in your account, do not move it; tell the bank in writing.
The website itself
If the scam has a site, the hosting company and the domain registrar can take it offline faster than any of the routes above, often within hours of a clear report.
Leave a Reply