# Is Hacking a Crime in Malaysia? What Victims Can Do > Yes. Hacking is an offence in Malaysia under the Computer Crimes Act 1997. What sections 3 and 4 say, police report versus civil claim, and what to keep. - URL: https://www.awarexone.com/research/hacking-crime-malaysia-victims - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-09-29 - Topics: Account security, Account recovery, Malaysia - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer Yes. Getting into someone else's account or computer without permission is an offence under section 3 of the Computer Crimes Act 1997. Make a police report at any police station, and call your bank first if money left your account. Save screenshots and security emails now. A police report does not return your account; the platform decides that. ## Summary - Yes, getting into someone else's account or computer without permission is an offence in Malaysia under section 3 of the Computer Crimes Act 1997. - Hacking is a police matter, so make your report at a police station, and call 997 and your bank first if money has left your account. - A police report can lead to a prosecution, but only the Public Prosecutor decides whether to charge anyone, and it does not return your account. - Suing the person is a separate civil case that you bring yourself, usually through a lawyer, and you first need to know who they are. - Save screenshots, security emails, dates and any money trail now, and never pay a hacker for hire to break back in. - This is general information, not legal advice, and the platform alone decides whether your account comes back. Someone got into your Instagram, your Gmail or your business Facebook Page. They changed the password, messaged your friends, maybe took money. Once the shock passes, the next thought is usually: this has to be illegal, so can I report them, and can I make them pay? The short answer is yes, hacking is a crime in Malaysia, and the police investigate it. Suing the person is possible in principle, but it is a separate and harder route. For most people the useful moves are a police report, the bank and 997 if money moved, and careful evidence. This guide explains what the Computer Crimes Act 1997 says, how a criminal report differs from a civil claim, what to save today, and where the law is heading. It is general information for victims, not legal advice. For advice on your own case, speak to a lawyer. Last checked: 29 September 2026. ## Is Hacking Illegal in Malaysia? Yes. Section 3 of the [Computer Crimes Act 1997](https://sherloc.unodc.org/cld/uploads/res/document/mys/computer_crimes_act_html/2014_Act_563_-_Computer_Crimes_Act_1997.pdf) (Act 563) makes it an offence to make a computer perform any function to get into a program or data you know you are not authorised to access. Section 4 covers doing that with intent to commit fraud, dishonesty or injury. MCMC's [FAQ on hacked accounts](https://www.mcmc.gov.my/en/faqs/online-content-problems/7-email-facebook-blog-site-account-was-hacked-what) says hacking falls under the Royal Malaysia Police (PDRM) and that you can lodge a report at any police station. If money was lost, call 997 and your bank before anything else. > Note: **General information, not legal advice.** This article summarises public law texts and official guidance as they stood on 29 September 2026. It does not cover every fact pattern and is not a substitute for advice from a Malaysian lawyer on your situation. ## What Do Sections 3 and 4 of the Computer Crimes Act Say? The Act is short. The version we read is the Attorney General's Chambers' online reprint, as at 1 December 2011, which lists no amended sections. These are the parts a hacking victim is most likely to hear about. *Summary of selected sections of Act 563 from the official reprint. Penalties are maximums stated in the Act; a court decides any actual sentence.* | Section | What it covers, in plain words | Why it may matter to you | | --- | --- | --- | | Section 3: unauthorised access to computer material | Getting into a program or data on any computer, knowing you have no right to. On conviction, a fine of up to fifty thousand ringgit, up to five years' imprisonment, or both. | The basic offence when someone logs into your account without permission. | | Section 4: unauthorised access with intent to commit a further offence | The same access, done to commit or help commit an offence involving fraud or dishonesty, or which causes injury as defined in the Penal Code. On conviction, a fine of up to one hundred and fifty thousand ringgit, up to ten years' imprisonment, or both. | Can come into play when the attacker used your account to cheat your contacts or take money. | | Section 5: unauthorised modification | Doing anything you know will change the contents of a computer without authority. | May be considered where data was altered or deleted. | | Section 9: territorial scope | The Act applies to anyone, of any nationality, inside or outside Malaysia, if the computer, program or data was in Malaysia or could be used with a computer here. | An overseas attacker is not outside the Act, though catching them is another matter. | | Section 12: prosecution | A prosecution needs the written consent of the Public Prosecutor. | You report; you do not bring the criminal case yourself. | Section 7 matters too. It treats abetting or attempting an offence under the Act as the offence itself. Keep that in mind if anyone offers, for money, to break back into your account. ## Police Report or Civil Claim: Which Route Fits? These are two different systems. A criminal case is the state acting against the offender. A civil claim is you acting against the person who caused you loss, usually for compensation. You can do the first without the second, and most victims do. *A general comparison, not legal advice. A lawyer can tell you whether a civil claim is realistic in your case.* | | Criminal route (police report) | Civil route (a claim in court) | | --- | --- | --- | | Who starts it | You report; PDRM investigates; the Public Prosecutor decides on charges | You, usually through a lawyer | | What it can lead to | Investigation, and possibly a charge and a sentence | A court order, for example for compensation, if you win | | What you need first | Your account of events and whatever evidence you have | The identity of the person you are claiming against, plus proof of loss | | Does it return your account? | No. Only the platform can do that | No. Only the platform can do that | | Who to ask | The police station where you report | A Malaysian lawyer | The hard part of a civil claim is usually the first step: knowing who to claim against. Attackers hide behind fake names and overseas numbers. MyCERT's [social media incidents FAQ](https://mycert.org.my/portal/advisory?id=SR-018.082022) says it cannot obtain an account holder's details from platforms such as Facebook, Instagram and TikTok. It explains that a court order or subpoena has to be sent to the platform, which then decides what to disclose. If you cannot afford a lawyer, the [Legal Aid Department](https://www.jbg.gov.my/index.php/en/services/legal-aid-services) (Jabatan Bantuan Guaman) provides legal aid in a list of civil matters set out in the Legal Aid Act 1971, subject to a means test. Ask them whether your situation is one of them. ## Where Should You Report a Hack in Malaysia? Each channel does a different job. Do them in this order: 1. If money has left your account, or friends paid the attacker, call your bank and the National Scam Response Centre on 997. The government's [NSRC 997 page](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) says to call within 24 hours of discovering the scam so accounts and transactions can be blocked. 2. Report the hack to the platform through its official hacked account flow. This is the only route that can give the account back. 3. Lodge a police report at the nearest police station, as MCMC's FAQ advises. Keep the report number. 4. Report the incident to CyberSecurity Malaysia's [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview), the national point of contact for computer security incidents. It can analyse what happened and help escalate abuse reports. Our guide on [where to report a hacked account in Malaysia](https://www.awarexone.com/research/report-hacked-account-malaysia) walks through each channel, what it needs from you and what it cannot do. ## What Evidence Should You Save Now? Evidence disappears fast. Attackers delete messages, platforms rotate login history, and your memory of the timeline fades. Collect this before you change much, but do not delay securing your email or calling your bank. - Screenshots of the account as it looks now, with the date and time visible, including the profile URL. - Every security email from the platform, such as notices that your password or email address was changed. Keep them in the inbox; do not delete them. - The platform's login activity page, if you can still reach it, showing locations and devices. - Messages the attacker sent from your account. Ask friends who received them to screenshot their side too. - Anything that identifies the attacker: usernames, phone numbers, links, bank account numbers they gave your contacts. - Bank statements and transaction references for any money that moved. - A short written timeline: when you noticed, what changed, who you contacted, and each report or case number. Cyber999 asks for similar material in an email report: the source and destination of the attack, email headers, log files and the time of the attack. Collecting it once serves the police, Cyber999, the platform and, if it comes to it, a lawyer. The same records help when you have to [prove the account is yours](https://www.awarexone.com/research/prove-social-media-account-ownership). ## Mistakes That Can Hurt Your Case Anger is normal. These moves feel like action but tend to backfire: - Paying a "hacker for hire" or "recovery expert" to break back in. It is a common scam, and section 7 of the Act treats abetting an offence as the offence. - Sharing your password, OTP, backup codes or login links with anyone who says they can help. No police officer, bank, platform or honest service needs them. - Posting the name and photo of the person you suspect and calling them a hacker. MCMC's own table of online offences lists defamation as a matter for the police and for civil action. - Deleting the account or wiping your phone before saving evidence. - Waiting to report money losses while you try to recover the account. The 997 window is about stopping money, and it is short. Fake helpers often pose as platform staff or "cyber police". Our guide to [fake Meta support scams](https://www.awarexone.com/research/fake-meta-support-scam-malaysia) shows the common scripts. > Warning: **Nobody legitimate asks for your codes.** PDRM, NSRC, Cyber999, your bank and the platform can all act on your report without your password or login codes. Anyone who asks for them, or wants payment to "trace the hacker", is not helping you. If you have already shared a code or paid, call 997 and your bank now. ## Is the Computer Crimes Act 1997 Being Replaced? Yes, in time. The Dewan Rakyat passed the Cybercrimes Bill 2026 on 1 July 2026, and [RTM reported](https://berita.rtm.gov.my/nasional/senarai-berita-nasional/senarai-artikel/ruu-jenayah-siber-2026-diluluskan-dewan-rakyat/) that it will repeal Act 563, with PDRM remaining the main investigating agency. [Bernama reported](https://www.bernama.com/bm/news.php?id=2583509) that the Dewan Negara passed it without amendment on 20 July 2026. A passed Bill is not yet law in force. At the time of writing we could not confirm from an official source that the new Act has come into operation, so this article describes the 1997 Act. Check the current position on the Attorney General's Chambers' [Laws of Malaysia portal](https://lom.agc.gov.my/) or ask your investigating officer. Either way, the practical steps above do not change: report, save evidence and protect your money first. ## What the Law Cannot Do for You > Note: **A report is not a recovery.** A police report, a Cyber999 case or a lawsuit does not give you your account back. Only the platform can restore access, and some accounts are never restored. The attacker may never be identified, and a prosecution depends on evidence and the Public Prosecutor's decision. That is why the platform's own recovery flow runs alongside everything else. If you are still working out what happened, start with our [first steps after a hack, written for Malaysian readers](https://www.awarexone.com/research/akaun-kena-hack-malaysia). ## When Expert Recovery Help Makes Sense Most people can follow the steps here alone. Outside help earns its place when the account runs a business, when the official recovery flow keeps rejecting you, or when you need your evidence organised for the platform, the police and a lawyer at once. SocialSafe by AwareXone, our recovery service, looks at the case before anything is agreed and works only through the platform's official processes. We do not give legal advice and we never ask for your password or codes. See how our [account security service](https://www.awarexone.com/services/account-security) works, and what we refuse to do, on our [Trust Center](https://www.awarexone.com/trust). ## Frequently Asked Questions ### Can I sue someone for hacking my account in Malaysia? Possibly, as a civil claim, but you usually need to know who they are and show what you lost. A Malaysian lawyer can tell you whether a claim is realistic. It is separate from any police case. ### What is the punishment for hacking in Malaysia? Under section 3 of the Computer Crimes Act 1997, a fine of up to fifty thousand ringgit, up to five years' imprisonment, or both. Section 4, access with intent to commit fraud or another offence, carries up to one hundred and fifty thousand ringgit, up to ten years, or both. ### Is it illegal to log into my partner's or ex's account in Malaysia? The Act treats access as unauthorised when you are not entitled to it and do not have consent from the person who is, so knowing a password is not the same as permission. Whether a particular case is an offence depends on the facts, so ask a lawyer. ### Can I make a police report online for a hacked account? MCMC's FAQ says to lodge hacking reports at any police station. Call 997 first if money is involved, then go in person. ### Will the police get my account back? No. The police investigate the crime; only the platform can restore the account. Run the platform's recovery flow at the same time as your report. ## Official sources - [Attorney General's Chambers: Computer Crimes Act 1997 (Act 563), online reprint as at 1 December 2011, hosted by UNODC SHERLOC (read 29 September 2026)](https://sherloc.unodc.org/cld/uploads/res/document/mys/computer_crimes_act_html/2014_Act_563_-_Computer_Crimes_Act_1997.pdf) - [UNODC SHERLOC: Computer Crimes Act, sections 3 and 4 (read 29 September 2026)](https://www.unodc.org/cld/en/legislation/mys/computer_crimes_act/part_ii/article_3-4/article_3-4.html) - [MCMC FAQ: Email/Facebook/blog site account was hacked. What should I do? (read 29 September 2026)](https://www.mcmc.gov.my/en/faqs/online-content-problems/7-email-facebook-blog-site-account-was-hacked-what) - [MCMC FAQ: Steps to lodge a complaint regarding content on the Internet (read 29 September 2026)](https://www.mcmc.gov.my/en/faqs/online-content-problems-2024/what-are-the-steps-required-for-me-to-lodge-compla) - [MyCERT: Social Media and Online Fraud Incidents FAQ, SR-018.082022 (read 29 September 2026)](https://mycert.org.my/portal/advisory?id=SR-018.082022) - [MyGOV Malaysia: NSRC 997 Hotline (read 29 September 2026)](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) - [Jabatan Bantuan Guaman Malaysia: Legal Aid Services (read 29 September 2026)](https://www.jbg.gov.my/index.php/en/services/legal-aid-services) - [Berita RTM: RUU Jenayah Siber 2026 diluluskan Dewan Rakyat (read 29 September 2026)](https://berita.rtm.gov.my/nasional/senarai-berita-nasional/senarai-artikel/ruu-jenayah-siber-2026-diluluskan-dewan-rakyat/) - [Bernama: Dewan Negara Lulus RUU Jenayah Siber 2026 (read 29 September 2026)](https://www.bernama.com/bm/news.php?id=2583509) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.