Police Report for Online Harassment in Malaysia

Someone keeps sending you abusive messages, has posted your home address, or has said they will hurt you or your family. You have blocked and reported them, and it has not stopped. Now you are wondering whether this is something the police will take seriously, or whether you will be told it is just the internet.

In Malaysia, threats, doxxing, extortion and sustained abusive messages are matters for the police, and you can report them even if you have lost no money. A report works best when you arrive with organised evidence and pair it with a platform report and an MCMC complaint.

This guide explains when a police report fits, what to bring, what happens after, and what a report can and cannot do. It is general information, not legal advice.

Last checked: 5 October 2026.

#Can You Make a Police Report for Online Harassment in Malaysia?

Yes. The PDRM public FAQ says that where there is an attempt at fraud, a threat, misuse of identity or another situation with an element of an offence, members of the public can come forward to make a police report for assessment and action. You do not need to have lost money first. For physical or death threats received online, MCMC's FAQ on threats says you may consider lodging a report immediately at the nearest police station for assessment under the Penal Code, and that MCMC will assist the police if necessary. If someone is in immediate danger, call 999.

#What Changed in July 2025

Until recently, many victims were told that online bullying did not fit neatly into any offence. That gap was the reason for a change in the law.

According to a media statement from the Legal Affairs Division of the Prime Minister's Department dated 11 July 2025, the Penal Code (Amendment) Act 2025 and the Criminal Procedure Code (Amendment) Act 2025 came into force that day. The statement says the amendments target bullying, including cyberbullying, and introduce new sections 507B to 507G covering threatening, abusive or insulting communications intended to cause emotional distress or fear. It adds that sharing someone's personal information without consent, known as doxxing, is now an offence that can carry up to three years in prison.

Older offences still apply too. MCMC's table of which agency handles which online offence lists property and life threats under the Penal Code, cheating by personation under the Penal Code, and hacking under the Computer Crimes Act 1997, all enforced by the Royal Malaysia Police (PDRM). For a plain-language look at the new sections and the Online Safety Act, see our explainer on Malaysia's online harassment laws.

#Which Situations Belong With the Police?

Not every unpleasant comment is a crime, and the police assess each report on its facts. The PDRM FAQ says reports that are civil disputes or fall under another agency may be referred to the appropriate channel. Use this table as a rough guide to where your situation fits.

If intimate images are involved, or someone is threatening to share them, put your safety first. Our guide to sextortion in Malaysia covers StopNCII, platform priority forms and how to report without sharing the images.

#Station or e-Reporting?

The PDRM FAQ says a report can be made at any nearby police station, and that for certain non-emergency cases a report can also be made through PDRM's e-Reporting system on its official website. That system is meant for lost documents and matters that do not involve a crime, and it tells you to go to the nearest station for anything with a criminal element. Threats, doxxing and extortion are crimes, so make the report in person. An officer can ask questions, see your evidence and judge how urgent it is, which a form cannot do.

You can go to any station; it does not have to be the one nearest the person harassing you. If you feel unsafe going alone, bring a friend or family member.

#What to Bring to the Police Station

The PDRM FAQ asks people to give complete information and bring related documents or evidence, and lists items such as chat screenshots, website links, email addresses and social media usernames. Prepare this before you go, ideally in one folder on your phone and a printed copy.

• Your identity card (MyKad) or passport.
• A one-page timeline: when it started, each incident with date and time, and which platform it happened on.
• The profile URL and username of every account involved, copied as text, not only as a picture.
• Screenshots of each threatening or abusive message showing the account name and the date. Take a full-screen capture so the phone's clock is visible too.
• The link to each post or comment, and a screenshot of it, in case it is deleted later.
• For doxxing: a screenshot of the post showing your personal details and where it was shared. Cover the details yourself before printing if you need to show it to others.
• Any reference numbers from reports you already made to the platform, and the platform's replies.
• If money was demanded or paid: account numbers, e-wallet IDs and receipts.
• The names of anyone who saw the threats and could confirm them.

Our evidence guide for harassment explains how to capture stories, lives and disappearing messages before you report or block, since a successful report or a block can hide the very content you need. If the harassment involves your private messages being posted, see what to do when someone posts your private chat screenshots.

#What to Say When You Make the Report

The PDRM FAQ advises stating the chronology clearly, including dates, times, how contact was made, the identity the suspect used and all related evidence. Keep it factual and in order. Officers write the report from what you tell them, so a clear account matters more than a long one.

1. Start with who you are and how you know the account, if you do.
2. Describe the first incident, then each later one in date order.
3. Quote the exact threatening words where you can, rather than summarising them.
4. Say why it frightens you: for example, they posted your street, or they named your child's school.
5. Say what you have already done: platform reports, blocks, an MCMC complaint.
6. Read the report back before you sign it, and correct anything that is wrong.
7. Ask for a copy of the report and note the report number before you leave.

Only report what actually happened. An exaggerated or false report can undermine a genuine case and can get you into legal trouble yourself.

#What Happens After the Report?

The PDRM FAQ is clear that a police report does not mean someone is arrested straight away. It is the start of a review or investigation, and any action, including an arrest, depends on the facts, the evidence, the needs of the investigation and the law. You may be contacted by an investigating officer for a statement or more evidence. Keep your report number handy for that call.

A police report also does not remove a post on its own. Platforms act on their own reports, and MCMC acts on complaints about harmful content. That is why the report works best as one of three parallel steps.

#Use the Police Report Alongside the Platform and MCMC

Each route does a different job. Use all three where they fit, in this order.

1. Report on the platform. MCMC's complaint steps put this first: report to the content owner, moderator or the site's report abuse tool, since a self-report by the person affected is prioritised. Instagram's page on threats to share private things likewise says to contact local law enforcement, report the person and block them.
2. Make the police report for threats, doxxing, extortion or sustained abuse, as above.
3. Complain to MCMC at aduan.mcmc.gov.my if the content stays up. MCMC asks for detailed information and supporting documents, and says copies of what you sent to the platform or other enforcement agencies should be included, so attach your police report. It says it acknowledges each complaint with a reference number.

The Online Safety Act 2025 came into force on 1 January 2026 and is enforced by MCMC. MCMC describes it as placing duties and obligations on licensed service providers, such as social media and internet messaging services. MCMC's reporting page for the Act says you can report directly to licensed service providers such as Facebook, WhatsApp and TikTok, or submit a report to MCMC. Our step-by-step MCMC complaint guide walks through the form.

#What Not to Do While the Report Is Open

• Do not threaten, insult or harass the person back. Your own messages can be read as part of the dispute.
• Do not try to find out who is behind an anonymous account by hacking, tracking or asking someone to dox them. Leave identification to the police.
• Do not ask friends to mass-report the account or flood its comments. Coordinated reporting can break platform rules and does not speed up a review.
• Do not pay anyone who offers to delete the content or unmask the account. Nobody outside the platform can promise removal, and these offers are often scams.
• Do not delete your own chats or account in frustration. That evidence is what the investigation relies on.
• Do not share passwords, login codes or backup codes with anyone offering help.

#When a Case Review Makes Sense

Everything above can be done on your own, and only the police, the courts, MCMC and the platforms can act on the person or the content. Some people want a second pair of hands with the platform side: working out which report route matches the harm, organising evidence for several posts across several apps, or following up when a report is rejected. SocialSafe by AwareXone reviews each request first and prepares rights-based reports through official platform and legal channels only. We do not identify or contact the person harassing you, we never file false or mass reports, and the platform makes the final decision; lawful content that is merely unpleasant usually stays up. Our content removal support page explains the review, and the Trust Center sets out what we will never ask for.

#Frequently Asked Questions