How to report a scam in Malaysia: NSRC 997, your bank and Semak Mule

What to do in the first hour after a scam

Speed decides how much money can be saved. In March 2026 the Home Minister said the first one to two hours are crucial, because syndicates use mule accounts to empty 80 to 90 per cent of a victim’s funds within three to ten minutes. In one case described by the Communications Minister, a victim who reported about eight hours after the transfer recovered only RM170,000 of RM1 million.

If more than a few hours have passed, still report. Banks and the police can act on later reports, and every report adds the mule account to the records used to warn others.

The NSRC 997 hotline explained

The National Scam Response Centre was set up by the government as a rapid response centre for online financial scams. It is led by the Royal Malaysia Police (PDRM), working with Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC) and the National Anti-Financial Crime Centre. It now operates from MCMC’s Menara 2 in Cyberjaya, having moved from the Bank Negara building in Kuala Lumpur.

• Hours: 24 hours a day, seven days a week. The 24-hour service started in September 2025. Some older bank and agency pages still show the earlier 8am to 8pm hours.
• Police report: since the 2025 changes, a call to 997 is treated as a police report. In March 2026 the Communications Minister confirmed that a separate police report is no longer needed for the NSRC to act.
• When to call: as soon as possible, and the official advice is within 24 hours of discovering the scam.
• What it covers: online financial scams where money has been transferred, including Macau scams, investment and cryptocurrency scams, love scams, online shopping scams, impersonation of banks and government agencies, and procurement fraud.

Once a report is lodged, the receiving accounts can be suspended and the transactions investigated, and recovered funds are returned to victims where possible. The amounts returned are rising, from about RM508,000 in 2024 to RM6.7 million in 2025, but most stolen money is still not recovered. Prevention matters more than recovery.

Important: the NSRC only receives calls. It does not phone, WhatsApp or message the public, and the police have said it runs no social media accounts. Fake “NSRC officer” calls have been used to steal millions of ringgit.

Freezing your bank account: kill switch and fraud hotline

Bank Negara Malaysia requires banks to give customers a convenient way to suspend their accounts if they suspect they have been compromised, and to provide dedicated hotlines for reporting scams. Most banks offer this as a kill switch in the mobile app or through the 24-hour fraud line. Once activated, online, card and ATM transactions are typically blocked until you reactivate the account with the bank.

Know where your own bank’s kill switch is before you need it. Practical tips:

• Save your bank’s fraud hotline number from its official website or the back of your card, not from a search result or message.
• If you paid by card, tell the bank so it can block the card and advise on any dispute process.
• Ask the bank for a reference number and write down the time of every call.
• If you are not satisfied with how your bank handled your complaint, Bank Negara’s BNMTELELINK channel takes escalated complaints.

Police reports and Semak Mule

Semak Mule is the Commercial Crime Investigation Department’s (CCID) public portal at semakmule.rmp.gov.my. You can search a bank account number, phone number or company name to see whether it has been linked to police scam reports. It has recorded more than 37 million visits since it launched in 2020.

Use it before you pay a new seller, landlord, “investment manager” or job agent. Two cautions:

• A clean result does not prove an account is safe. New mule accounts appear every day and only reported accounts are listed.
• Semak Mule is a checking tool, not a reporting channel. To report, call 997 and your bank.

Do you still need a police report? For the NSRC to act on a transfer, calling 997 is enough. You may still want a written police report at the nearest station if your bank, insurer or employer asks for one, if the scam involved threats, extortion or identity theft rather than a transfer, or if you could not get through to 997.

Allowing your own account to be used by scammers is itself a crime. Penal Code amendments passed in 2024 (sections 424A to 424D) make it an offence to let others control your bank account or payment instruments for unlawful transactions. Never “rent” or lend your account, and report anyone who asks.

Common scams in Malaysia and their red flags

Seeing these patterns before they happen helps more than any hotline. The WorkQuest2U Scams 101: The Scam Map and Scam Smart: AI Tricks to Watch For lessons let staff practise spotting red flags in a 3D scene, and If You Have Been Scammed walks through the reporting steps above.

What employers should put in place

Scams hit staff at home and the company at work. A short scam response plan covers both:

• Publish the numbers. Put 997 and the steps above on the intranet, staff app and payslip notes.
• Train regularly. Short scenario lessons on scam types, malicious apps and mule recruitment, with a refresher when new scams appear. Our guide to phishing awareness training covers what to include.
• Protect company payments. Verify any change to supplier bank details by calling a known number, and require a second approver for urgent transfers. See Payment Fraud & Scams.
• Support victims. Give staff who report a scam time off to call the bank and the NSRC, and point them to the employee assistance programme. Shame keeps people silent, and silence costs recovery time.
• Warn about mule recruitment. Young staff and interns are targeted with offers to “rent” their bank accounts. Make clear that this is a crime.
• Customer-facing teams. If your staff handle customer money or accounts, they need extra training on helping a victim and spotting account takeover. The Cybersecurity topic’s Scam Prevention certificate groups those lessons, including Helping a Scam Victim and Mule Accounts.

This guide is general information based on official guidance as of October 2026. Hotline hours and procedures can change, so check the official NSRC and bank pages when in doubt.