Macau Scam and Investment Scams in Malaysia: What to Do

A "police officer" just told you your IC was used to open an account for money laundering, and you must move your savings to a safe account while they investigate. Or an investment group on WhatsApp showed your profits climbing for weeks, and now the app wants a fee before you can withdraw a single ringgit.

The short answer: both are scams. If money has moved, call your bank's hotline or 997 now, then make a police report. No real officer, bank or court asks you to transfer money by phone, and nobody genuine, including us, will ever ask for your password, PIN, TAC or OTP.

This guide covers how both scripts work in Malaysia, the red flags, the first hour if you paid or shared banking details, the scammer's social media and messaging accounts, and the recovery scam that often follows.

Last checked: 29 September 2026.

#Is This a Macau Scam or an Investment Scam, and What Do I Do Now?

A caller claiming to be police, LHDN, Bank Negara Malaysia, a bank, a courier or a court who says you are linked to a crime and must transfer money is running a Macau scam. An online scheme that promised high returns and now blocks withdrawals until you pay more is an investment scam. Either way, stop paying, call your bank's 24-hour hotline or the National Scam Response Centre (NSRC) on 997, then make a police report at the nearest station. The NFCC's page on the NSRC says quick action can reduce losses, but there is no guarantee you will get the money back.

#How the Macau Scam Script Works

A Macau scam is a phone scam that runs on fear. BSN's Macau scam page describes callers posing as police, court, LHDN, Bank Negara Malaysia or customs officers who say you are linked to a crime, owe tax or have an illegal parcel, and demand money to "clear your name".

In January 2026 the director of Bukit Aman's Commercial Crime Investigation Department (CCID) told The Star that victims are passed to a second "authority figure" who links their bank account to money laundering, drugs or tax arrears, and are told to tell no one. Some syndicates use Caller ID spoofing, so the number on your screen can look local or official.

Bank Negara Malaysia's warning about people impersonating its officials is plain: it will never ask individuals to transfer money for safekeeping. LHDN's own scam alert lists the tax versions, from fake arrears and "safe" accounts to demands for "profit tax" on investments that do not exist. That last one is where the two scams meet.

#How Online Investment Scams Work in Malaysia

An investment scam sells a return that does not exist. The Securities Commission Malaysia's Beware of Scams page names three promises to walk away from: "Tidak akan rugi" (guaranteed profit), "Indah khabar dari rupa" (too good to be true) and "Untung besar" (huge returns).

A clone investment case the CCID shared in January 2026, reported by Bernama, shows the usual path: a Facebook advert, a WhatsApp group, a trading app showing large paper profits, many transfers to third party accounts, then a withdrawal fee of 30 per cent of the "profits". The CCID's red flags: unauthorised apps, transfers to third party accounts, limits on withdrawing, and extra fees or "taxes" to withdraw.

Many entries on Bank Negara Malaysia's Financial Consumer Alert List point to Facebook adverts, Instagram posts, Telegram channels and WhatsApp group links, often marked "potential clone entity": a scheme copying a real firm's name, logo or registration details. The Securities Commission's Investor Alert List flags similar clones and trading apps.

#Red Flags You Can Spot Before You Pay

• A caller says you are under investigation, then tells you to keep it secret, even from your family.
• Anyone asks you to move money to a "safe", "verification" or "investigation" account.
• A caller or chat asks for your online banking login, PIN, TAC or OTP, or your ATM card.
• An investment promises high or risk-free returns, or claims approval you cannot find on a regulator's site.
• The "company" talks only through WhatsApp, Telegram or social media, and wants payment into a third party account.
• You can see profits on screen but must pay a fee, tax or deposit before you can withdraw.

#What Real Agencies and Licensed Firms Do Instead

Genuine officials leave a trail you can check. In a statement reported by Kosmo, the CCID director said police do not investigate through phone calls alone, ask witnesses to attend a station, and do not freeze anyone's bank account without evidence.

To check a caller, end the call and contact the agency through its official website, never the number the caller gave you. To check an investment, search the name in the Securities Commission's Investment Checker, which shows licensed persons and warns you if a name is on its alert list.

#Paid or Shared Banking Details? The First Hour

Deal with the money first. The NFCC's NSRC page says to contact your bank's 24-hour hotline or 997 as soon as you realise, before the police report, so action starts quickly. The government's 997 page lists Macau scams and investment scams among the cases the NSRC handles.

1. Stop every payment and cut contact. Do not send "one last" fee to unlock a withdrawal or close a case.
2. Call your bank's hotline, printed on the back of your card or on the bank's official website, or call 997. The NFCC says that if you cannot get through to 997, call your bank directly.
3. Tell the bank every transfer, and whether anyone has your banking login, PIN, TAC or ATM card.
4. Make a police report at the nearest police station. The NFCC says the police cannot follow up without a report, and asks for it within 24 hours of calling your bank or 997.
5. Follow up with the investigating officer on your report. The NFCC says 997 is not a case follow-up line.

If more than a day has passed, the NFCC still asks you to report to your bank, even though the chance of recovery is lower.

If the scammer had you install an app, uninstall it and change your banking and email passwords from another device; our guide on what to do after clicking a phishing link covers the device checks. Report a malicious app or fake investment site to CyberSecurity Malaysia's Cyber999, by online form, email, phone or its app.

#Evidence Checklist for Your Bank and Police Report

The NFCC lists what to have ready. Gather it while you wait on the line, and delete nothing:

• A short timeline: the first call or advert, each conversation, each payment.
• Your details: name, phone number, IC number and bank account number.
• The scammer's details: names and ranks used, phone numbers, WhatsApp or Telegram accounts, dates and times.
• Every transaction: receiving account numbers, amounts, times and receipts.
• Website addresses, app names and any links they sent.
• Call logs and screenshots of chats, Facebook pages, adverts and any "warrant" or "letter" they sent you.

#What to Do With the Scammer's Social Media and Messaging Accounts

Collect first, then report. Screenshot the profile, username, link and chat before blocking, because the account may vanish once reported.

• Facebook or Instagram advert or profile: use the menu on the post or profile to report it as a scam. Facebook's scam guidance says not to respond, and to report it.
• WhatsApp or Telegram chat: use the app's own report option on the chat or group, then block and leave. Keep the chat on your phone for your police report.
• A suspected unlicensed investment scheme: alert the Securities Commission through the contacts on its scam page.

Check your own accounts too. If you shared a login code, or your WhatsApp or Facebook suddenly logged out, someone may be messaging your contacts; see our guide to a hacked account messaging your friends.

If your own account is blocked as a suspected mule, the NFCC says to contact your bank, not 997, and to use the bank's complaints unit, then Bank Negara Malaysia's BNMLINK, if you disagree. The mule account guidance asks you to tell your bank and the police at once if someone else gains access to your account.

#Check Semak Mule and the Alert Lists Before Any Transfer

PDRM's Semak Mule portal checks a bank account number, phone number or company name against scam reports, and a PDRM statement urges everyone to use it before any online transaction. A clean result does not prove an account is safe, and the CCID notes that SSM registration does not either, because company accounts are also used as mules. For investments, pair it with the Securities Commission's latest alert list update.

#The Second Scam: Offers to Recover Your Money

Victims are targeted again. In April 2026 the CCID warned, in a statement reported by Malay Mail, of syndicates posing as NSRC staff who advertise "recovery" on Facebook, contact victims on WhatsApp and demand fee after fee. The CCID said no individual or agency can guarantee the recovery of scammed funds, especially by charging a service fee.

The same trick targets people with hacked social media accounts; see our explainer on fake Meta support messages.

#Mistakes That Make the Loss Bigger

• Paying one more fee because the withdrawal or the "case closure" seems close.
• Waiting until morning to call the bank.
• Calling 997 but never making the police report.
• Paying a recovery agent, lawyer or "officer" who contacted you first.

#When a Case Review Makes Sense

Getting money back is a matter for your bank, the NSRC and PDRM, and you can do every step above alone. AwareXone does not recover money, unfreeze bank accounts or deal with banks or the police for you. Outside help can add something on the account side afterwards: a WhatsApp, Instagram or Facebook account the scammers took over, or an email you need to lock down after sharing a code. SocialSafe by AwareXone reviews that kind of case and tells you plainly whether the official routes are still open. See our account security service; our Trust Center lists what we will never ask for, starting with passwords and codes. The platforms make the final decision on any account.

#Frequently Asked Questions