Glossary

Plain-English definitions for scam and fraud terms used across JagaShield.

• BEC (business email compromise)

  A scam where an attacker compromises or spoofs a business email account (often a supplier's) and injects a fake instruction — a changed bank account for an invoice, most commonly — into what looks like a normal thread. The defence is always the same: verify any payment-detail change by phone, using a number you already had on file, before paying.

• BNM Financial Consumer Alert List

  A list published by Bank Negara Malaysia of entities not authorised by BNM to offer financial products or services it regulates. It is a warning list, not a licence register — BNM states expressly that absence or removal from the list is not confirmation that an entity is or has been licensed.

• Clone firm

  A scam entity that impersonates a real, legitimate, licensed firm — copying its name, branding, or registration details — to look credible. Both BNM's and the SC's alert lists carry entries marked "potential clone." The flagged entry is the impersonator; the legitimate firm being impersonated is not the one under suspicion.

• Deepfake scam

  A scam using AI-generated fake video, images, or voice — for example a cloned voice of a "relative" asking for urgent money, or a fake video of a public figure endorsing an investment. Treat any urgent money request that arrives only through a single audio or video clip with suspicion — verify by calling the person back on a number you already have.

• e-Invois / MyInvois

  MyInvois is LHDN's national e-invoicing system, rolled out to businesses in phases. It is a real government system — but that also makes its name useful to scammers. Treat any message about e-invoicing "fees," "registration," or "penalties" with the same check as any other LHDN message: genuine correspondence comes from an @hasil.gov.my address, and LHDN's own fraud-alert page (hasil.gov.my/polisi-portal/peringatan-penipuan) is the authority on what its real notices look like.

• Kill switch

  An in-app control, which BNM requires banks to provide, that lets you instantly freeze your own accounts and cards from your phone if you suspect your login or card details have been compromised. Scope (which accounts, how full a freeze) varies by bank — check yours before you need it, not after.

• Love scam

  A scam built on a fabricated romantic relationship, usually online, that runs for weeks or months before the scammer introduces a financial "crisis" — a medical emergency, a customs fee on a gift, a business opportunity — and asks for money, often repeatedly. Refusing video calls with a consistent excuse is one of the most reliable warning signs.

• Macau scam

  A phone scam where the caller impersonates police, LHDN, Bank Negara, a court, or customs, accuses the victim of a crime (money laundering, a parcel with contraband, an unpaid summons), and pressures them to transfer money to a "safe account" or pay a fine immediately to avoid arrest. No genuine authority resolves a case or clears your name over a phone-transferred payment.

• Mule account

  A bank account used to receive and move money from a scam, usually not the account holder's own scam. Some mule accounts are stolen or taken over by malware; many are recruited — an owner lends, sells, or is tricked into handing over access, sometimes for a fee. Malaysian authorities can investigate an account holder even if they claim not to have known the money was illicit, which is why "rent your account for RM200" offers are a serious legal trap, not easy money. See the mule account scam type and the guide for someone already accused of this.

• NSRC / 997

  The National Scam Response Centre, reached by calling 997. One call connects police (PDRM), Bank Negara Malaysia, MCMC and the banks to try to freeze scam proceeds before they move further. Whether a 997 call also removes the need for a station police report is disputed: NFCC and Bank Negara Malaysia both say lodge one anyway, while two ministerial statements say 997 is now enough on its own. Lodge it — that is the cheap side of the uncertainty.

• Phishing / smishing / vishing

  Three names for the same trick over different channels: phishing is a fake email or web page, smishing is a fake SMS/WhatsApp message, vishing is a fake phone call — each designed to steal your banking credentials or a TAC/OTP by impersonating someone you'd normally trust, like your bank or a government agency.

• SC Investor Alert List

  A list published by the Securities Commission Malaysia of unauthorised entities and individuals. It is not exhaustive, in the SC's own words, and some entries are marked "potential clone" — meaning the listed name belongs to a legitimate licensed firm being impersonated, not that the real firm is unauthorised. Check the marker before drawing any conclusion.

• Semak Mule

  PDRM's official portal (semakmule.rmp.gov.my) for checking whether a bank account or phone number has a fraud report against it. "No record" means unknown, not clean — scammers rotate accounts constantly. Type the address directly; lookalike portals exist.

• SSM

  Suruhanjaya Syarikat Malaysia — the Companies Commission of Malaysia. An SSM search confirms a business is registered. It does NOT confirm the business is licensed to do whatever it claims to do (like taking investment money) — registration and licensing are two separate checks. See BNM's and the SC's licensed-entity registers for licensing.

• TAC/OTP

  A Transaction Authorisation Code or One-Time Password — a short-lived numeric code your bank sends to confirm you (and only you) are authorising a transaction. No bank or government agency will ever legitimately ask you to share, forward, confirm, or read one out. A message that simply notifies you of a code ("Your OTP is 123456, do not share this with anyone") is normal; a message that asks you to hand it over is the scam.

• Task scam

  A scam disguised as a simple paid "job" — rating products, clicking links, testing an app — that pays small real amounts at first to build trust, then asks the victim to deposit increasing sums of their own money to "unlock" bigger rewards that never arrive. A close relative of investment and mule-account scams.