Scammed in Penang? Call 997 or your bank at once

The short version

1. Money gone? Call your bank's 24-hour hotline or 997 now. The faster you call, the better the chance funds can be blocked. There is no guarantee you will get the money back.
2. Then make a police report at the nearest police station, within 24 hours.
3. Never give anyone your OTP, TAC, PIN or password. The police, Bank Negara, the NSRC and banks will never ask for them.
4. Before you pay a stranger, check their account or phone number on PDRM's Semak Mule portal.

Step 1: call your bank or 997

The National Scam Response Centre (NSRC) handles online financial fraud: money moved out of your account without your knowledge, or money you were tricked into transferring online. This includes phishing, Macau scams and malware.

• Your bank's 24-hour hotline: the number is on the back of your card and on the bank's website.
• NSRC: 997.

When can you call 997? Sources differ. The NSRC FAQ on the government's NFCC website says 997 runs from 8.00am to 8.00pm every day, including public holidays. But in March 2026, the Home Minister said the NSRC now operates 24 hours a day, seven days a week, from its new premises at MCMC in Cyberjaya. If 997 does not answer, the FAQ says to call your bank's 24-hour hotline.

"The faster the victim calls 997, the faster Bank Negara Malaysia can block the stolen funds," Communications Minister Fahmi Fadzil said in March 2026.

Sources: NFCC, NSRC FAQ and Malay Mail, 3 March 2026, read 2026-10-14.

What to have ready

The NSRC FAQ says to have:

• a short account of what happened, in order;
• your name, phone number, IC number and bank account number;
• the scammer's name and phone number, with dates and times;
• transaction details: the bank accounts involved, the amount and the time;
• the transaction receipt;
• any website address the scammer sent;
• your messages with the scammer (SMS, WhatsApp, Telegram, email, calls), as screenshots.

Source: NFCC, NSRC FAQ, read 2026-10-14.

Step 2: make a police report

The FAQ says you still need a police report, made within 24 hours. Without one, the police cannot follow up. Call your bank or 997 first, then go to the nearest police station. To follow up later, contact the investigating officer on your case, or the Commercial Crime Investigation Division (JSJK) at your district police headquarters. 997 is not for follow-ups.

Source: NFCC, NSRC FAQ, read 2026-10-14.

Even if it was days ago

The FAQ says to report it to your bank even if the scam happened more than 24 hours ago. The chance of recovering money is slim by then, but the report helps the authorities act against the scammers.

Your account was blocked?

Do not call 997. The FAQ says an account may be blocked if it is suspected of being used as a mule account. Contact your bank. If you are not satisfied with its answer, you can take the complaint to Bank Negara: the FAQ points to BNM TELELINK at bnm.gov.my/LINK.

Source: NFCC, NSRC FAQ, read 2026-10-14.

Check a number or account: Semak Mule

PDRM's Semak Mule portal, semakmule.rmp.gov.my, lets you check bank accounts, phone numbers and company names suspected of involvement in financial crime. In October 2025, it held 299,531 bank accounts, 233,568 phone numbers and 7,867 company names linked to commercial crimes.

Source: The Vibes, 30 October 2025, read 2026-10-14.

The scams Penang police see most

Penang police recorded 7,852 online fraud cases from 2022 to 2024, with losses of RM312.86 million, Bernama reported in February 2025:

Bank Negara's scam education pages cover Macau scams, mobile application scams, mule accounts, phishing, illegal deposit taking and illegal forex trading. Its contact centre, BNMLINK, is on 1-300-88-5465, Monday to Friday, 9am to 5pm.

Sources: theSun (Bernama), 20 February 2025 and Bank Negara Malaysia, Financial Scam Education, read 2026-10-14.

Related

• Sell or give away second-hand, safely
• Who to call in Penang