Investment Scams in Malaysia and How to Avoid Them

Investment scams are the largest slice of Malaysia's online fraud losses. The Home Ministry reported that Malaysians lost RM2.97 billion to online scams in 2025, up from RM1.57 billion in 2024. Within that, non-existent investment schemes were the single biggest category.

These figures come from different bodies (Home Ministry, Bank Negara Malaysia, NSRC) with different framings and reporting periods, so totals vary between reports. One account cited around RM2.8 billion for 2025 while the Home Ministry cited RM2.97 billion. Treat each number as attributed to its source and year rather than a single official tally.

The pattern behind the money is consistent. Victims are approached online, shown fake returns on a slick app or website, and allowed to withdraw a small amount early to build trust. Once a larger sum is in, withdrawals stop and the victim is asked for more. This guide covers how to check an investment before you put money in, and what to do if you have already paid.

Scams keep changing their branding, but they reuse a small set of structures. Learn the shapes and the specific promise stops mattering.

Illegal deposit taking is regulated by BNM under the Financial Services Act 2013 and Islamic Financial Services Act 2013. Capital-market schemes (shares, unit trusts, funds, digital assets on registered platforms) are regulated by SC under the Capital Markets and Services Act 2007. Taking deposits or running an investment scheme without authorisation is an offence.

For anything that looks like a capital-market product (shares, unit trusts, funds, or crypto and digital assets on a registered platform), the Securities Commission Malaysia (SC) is your first stop.

Two checks, in this order:

1. Positively confirm the licence. Use the SC Investment Checker (sc.com.my/investment-checker) and the Public Register of licensed and registered persons, published under Sections 77 and 79 of the Capital Markets and Services Act 2007. This tells you whether an entity or individual is actually licensed for a regulated activity. There is also a List of Licensed Intermediaries.
2. Check the Investor Alert List (sc.com.my/investor-alert-list). This is a searchable list of unauthorised entities and individuals, including "potential clone" firms that impersonate licensed companies. It carried dated snapshots roughly weekly to monthly through late 2025 (for example, "as at 24/12/2025").

Read the SC's own caveat carefully. The Investor Alert List is not exhaustive, and absence from the list does not mean an entity is licensed. That is why the positive check on the Investment Checker and Public Register matters more than a clean result on the alert list. Investing through unauthorised parties means you are not protected under Malaysian securities laws.

SC public contact line: +603 6204 8999.

Bank Negara Malaysia (BNM) covers banking, forex, money-changing, and deposit-taking. If a scheme claims to be a bank, a licensed money changer, a forex dealer, or takes "deposits" with a promised payout, check BNM.

BNM Financial Consumer Alert List (FCA List): bnm.gov.my/financial-consumer-alert-list. It lists entities and schemes that are wrongly perceived or represented as being licensed or regulated by BNM.

The same caveat applies as with SC. The FCA List is not exhaustive, and removal from or absence from the list is not confirmation that an entity is licensed. Use it to catch known bad actors, then confirm any genuine claim of BNM regulation directly with BNM.

BNMTELELINK public line: 1-300-88-5465.

Which regulator for which product:

SC and BNM have jointly cautioned the public against internet investment schemes and advised investing only with licensed parties. When in doubt, a scheme that dodges both registers is one to walk away from.

A short routine catches most scams before any money moves. Do all of it, and do it yourself.

The checklist:

1. Identify the product, then pick the regulator: SC for capital-market products, BNM for banking, forex, and deposit schemes.
2. Positively confirm the licence on the SC Investment Checker and Public Register (or confirm any claimed BNM regulation with BNM). A licence you can find on the regulator's own site beats any certificate the promoter shows you.
3. Search the alert lists: the SC Investor Alert List and the BNM Financial Consumer Alert List. Remember absence is not clearance.
4. Verify contact details independently. Look up the company's real phone number and address on the regulator's website, then call that number. Do not use links, apps, or numbers the promoter sends you.

Watch for clone firms. A growing tactic is to copy a real licensed company's name, logo, and even its licence number, then set up a lookalike website or app. The licence number checks out because it belongs to the genuine firm. The giveaway is the contact route: the scammer's website, WhatsApp number, or bank account will not match what the regulator has on file. If the person licensed to that firm cannot be reached through the official channel, you are talking to an impostor.

You can also run a bank account number, phone number, or company name through Semak Mule (semakmule.rmp.gov.my), the PDRM Commercial Crime Investigation Department portal, to see if it has been reported for scam or mule activity.

Pig butchering is the name for a romance-investment scam that has grown fast in Malaysia. The mechanics are patient and deliberate.

How it plays out:

• A stranger connects with you on social media, a dating app, or even a "wrong number" text, and builds a warm relationship over days or weeks.
• Once trust is established, they introduce an investment, usually crypto, on an app or platform they recommend.
• The platform shows healthy gains. You are encouraged to start small, and you can even withdraw a little at first, which feels like proof it works.
• You put in more. Then withdrawals freeze. To "release" your funds you are told to pay tax, fees, or a top-up. Each payment leads to another demand, until you stop or run out.

These operations are largely run by transnational syndicates working from scam compounds in parts of Southeast Asia, often using trafficked and forced labour. The person messaging you may be a victim too. Their losses feed into Malaysia's love-scam and investment-scam figures.

Protective habits: be suspicious of any new online contact who moves the conversation toward money, never invest through an app introduced by someone you have only met online, and treat a small successful "test" withdrawal as bait rather than proof. A genuine platform does not need a personal introduction from a romantic interest to let you in.

Most scams trip at least one of these wires. One red flag is a reason to slow down. Several together is a reason to walk away.

The single most reliable rule is the first one. Anyone who guarantees a high return with no risk is either breaking the law or lying. Add the withdrawal trap: once you have to pay to get your own money out, the money is already gone and further payments only deepen the loss.

Speed decides how much you can save. Funds can be moved out of the receiving account within hours, so act the moment you realise something is wrong.

Do this now, in order:

1. Call NSRC 997. The National Scam Response Centre coordinates a war-room with banks and police to try to freeze and trace the funds. Under the current police-led setup, the 997 call is treated as initiating an official report. Call the moment money has left your account.
2. Call your bank's fraud line and ask for a recall or hold on the transfer. The faster the bank flags the receiving account, the better the chance of a freeze.
3. Lodge a police report and keep a copy. Even though 997 initiates a report, a formal report is useful for bank, insurance, and follow-up records.
4. Preserve evidence: screenshots of chats, the website or app, transaction receipts, and the scammer's phone and bank account numbers.
5. Report the entity to SC (for investment schemes) or BNM (for banking and forex), so it can be added to the alert lists.

The NSRC was announced on 14 October 2022 as a joint operation of the NFCC, PDRM, BNM, MCMC, and financial institutions and telcos. It expanded from 8am to 8pm daily to 24/7 operations during 2025 and is now police-led. Useful lines: NSRC 997, PDRM CCID Scam Response Centre 03-2610 1599 / 03-2610 1559, BNMTELELINK 1-300-88-5465.

After a scam, victims are often targeted a second time by a "recovery" offer. PDRM has warned about this repeatedly, in May 2025 and again in April 2026.

How the double scam works: syndicates identify people who have already lost money, then pose as fund-recovery specialists who can get it back for a fee. They frequently impersonate the NSRC or NFCC, wave fabricated "appointment letters", advertise on Facebook, and approach victims over WhatsApp. They ask for an upfront payment, often split across several bank accounts, and then vanish or keep asking for more.

The rule that keeps you safe: no legitimate agency charges an upfront fee to recover scammed money. Anyone who guarantees to recover your funds for a payment is running a second scam. The NSRC, NFCC, PDRM, SC, and BNM do not cold-call or WhatsApp victims to sell a paid recovery service.

If someone contacts you offering to recover your losses, do not pay and do not share more details. Report them the same way you would any scam: verify any claimed official identity through the regulator's or agency's own published number, and lodge a report. Recovery-scam cases are small in count but real; several have been logged with tens of thousands of ringgit lost on top of the original fraud.

Bookmark these. When a pitch lands, you can run the checks in a few minutes.

Two habits cover most of the risk. First, confirm a licence positively on the SC or BNM register before you send any money, and do it through the regulator's own website. Second, if you are ever asked to pay more to withdraw, or to pay a fee to recover a past loss, stop and treat it as a scam.