Step 1 — Call 997 (NSRC)
One call connects the police (PDRM), Bank Negara Malaysia, MCMC and the banks. Have ready: your IC number, your account details, the scammer's account or phone number, the amount, the transaction time, and screenshots.
Call 997 at any hour. If you cannot get through, call your bank's 24-hour fraud line immediately — do not wait.
On 997's staffed hours, official sources disagree, and this page states both rather than pick one. malaysia.gov.my lists the NSRC as "Daily (24 hours)". NFCC's own page lists 8.00am–8.00pm daily and directs after-hours victims to their bank, and Bank Negara Malaysia's scam FAQ gives the same 8am–8pm window. A move to 24-hour operation was announced by the Deputy Communications Minister on 26 Jul 2025, effective September 2025, and reported by Bernama, The Star and NST. All checked 23 Aug 2026. Whichever is true right now, the instruction above is the one that's harmless if unnecessary and costly if skipped — so it's the one to follow.
Step 2 — Lodge a police report
Official sources disagree on whether this is still required, so this page states both positions rather than pick one.
Two agencies say it is. NFCC, which runs NSRC, states that reports "must be made within 24 hours" and that "if no police report is made, follow-up action cannot be carried out by the police". Bank Negara Malaysia's own scam FAQ likewise tells victims to call their bank or 997 and lodge a police report at the nearest station.
Two ministerial statements say it is not. On 26 Jul 2025 the Deputy Communications Minister announced that from September 2025 a 997 call would be treated as a police report. On 04 Mar 2026 the Government Spokesman said: "We no longer need to make a separate police report; 997 is enough" — because NSRC now has police officers taking reports directly.
All four checked 23 Aug 2026. Lodge the report anyway. If the ministers are right, it cost you an hour. If the agencies are right, skipping it costs you the investigation. Bring the same evidence pack you used for the 997 call.
Step 3 — Call your bank's 24-hour fraud line
Ask the bank to raise a recall on the transfer and to flag the receiving account through NSRC. Banks are required by BNM to provide an in-app kill switch that freezes your own accounts and cards — use it if the scammer has your login details. Scope varies by bank; check yours on the banks directory.
Step 4 — Preserve evidence
Screenshots of the chat, the number or account you paid, receipts, the ad or website. Don't delete the conversation, and don't factory-reset your phone yet if you suspect malware — see the APK guide first.
Step 5 — Check and report the account on Semak Mule
Semak Mule is PDRM's official database of reported mule accounts. Type the address directly rather than clicking a link from a message — lookalike portals exist. If your browser shows a certificate warning on the real portal, that's a known server-side issue with the government site's certificate chain, not proof of a fake. Check the address bar, not the padlock.
Your own report helps the next person's check come back flagged.
Step 6 — Know what recovery realistically looks like
If NSRC freezes the funds before the mules cash out, you may get some or all of it back. If the money has already been layered through several mule accounts, recovery is rare. Be wary of "recovery agents" who promise to get your money back for a fee — that's a second scam.
FAQ
Do I still need to go to a police station if I've already called 997?
Unclear, and that is the honest answer. NFCC and Bank Negara Malaysia both still say yes; the Deputy Communications Minister (Jul 2025) and the Government Spokesman (Mar 2026) both said 997 is now enough on its own. Nobody has reconciled the two. Lodge the report — it is the cheap side of the uncertainty.
Can the bank refund me if I authorised the transfer myself?
Not automatically. Banks assess these case by case, and a transfer you approved yourself (even under deception) is harder to reverse than an unauthorised one. Raising a recall quickly, before the money moves further, is what actually improves your odds.
What if it happened at night or on a public holiday?
Call 997 regardless — see the hours note in Step 1 above. If you can't get through, go straight to your bank's 24-hour fraud line; most major banks staff this around the clock even when 997 itself may not be.