Semak Mule: How to Check a Scammer Number in Malaysia

A seller on Facebook Marketplace wants the deposit first. A friend messages from Instagram asking to borrow money until Friday. Someone in your comments says they can get your hacked account back for a fee. Each of them gives you a bank account or a phone number, and you want to know if it belongs to a scammer before you send anything.

The short answer: check it on Semak Mule, the Royal Malaysia Police (PDRM) portal, before you pay. A match is a clear reason to stop. A clean result is not a green light, so treat it as one check among several.

This guide shows how to use the portal, how to read each result, when to run a check on social media, and what to do if your money has already gone.

Last checked: 5 October 2026.

#What Is Semak Mule and How Do You Check a Scammer Number?

Semak Mule is a free public portal run by PDRM's Commercial Crime Investigation Department at semakmule.rmp.gov.my. The government's MyGOV page on the scammer account verification portal tells anyone who suspects a phone number, bank account number or company name of fraud to check it there. Choose the category, type the number or name, enter the captcha words and search. If the portal finds a record, do not pay and report the profile that gave you the number. If it shows "No Records Found", the number has simply not been reported yet; keep checking the person by other means.

#How to Use the Semak Mule Portal Step by Step

The portal can be switched between English, Bahasa Malaysia, Chinese and Tamil. The labels below are the ones it shows at the time of writing; the layout can change.

1. Type semakmule.rmp.gov.my into your browser yourself. Do not tap a "check here" link sent by the person you are checking, or by anyone you do not know.
2. Find the search box headed "Check Accounts with Reports" (in Malay, "Semak Akaun yang ada Report").
3. Under "Select Category", choose bank account number, telephone number or company name.
4. Type the number in full, digits only, with no spaces or dashes. For a company, type its name. The portal asks for at least three characters.
5. Type the words shown in the image into the box labelled "Words in the Left Image". If you cannot read them, refresh for a new image.
6. Search and wait. The portal may show "Please Wait, While Connecting to CCIS Server" while it queries PDRM's records.
7. Take a screenshot of the result with the date and time visible, whatever it says.

The portal does not explain which phone format it stores. If a phone number returns nothing, it is reasonable to try again with and without the country code, but do not treat a second clean result as extra proof.

#Reading the Result: What Each Outcome Means

There are really only two outcomes, and people misread the second one far more often than the first. In a press report PDRM republished on its website, the director of its Commercial Crime Investigation Department describes the portal as a list of mule bank accounts, phone numbers and shell companies used by scammers, set up in 2020 and later extended to company names.

Some guides quote other wording for a match, such as a red warning banner. The exact text can change between versions, so read it simply: anything other than "No Records Found" for your search is a reason to stop.

#Why "No Records Found" Does Not Mean Safe

A clean result only tells you what the police already know. Scam syndicates rotate phone numbers and open or rent new mule accounts, so the number in front of you may be days old with no victim yet. PDRM's FAQ defines a mule account (akaun keldai) as a bank account that someone else uses to receive, move or withdraw money linked to crime. Those accounts often belong to ordinary people who lent or sold them, which is why a fresh one looks clean.

• A hacked friend's account will give you the scammer's number, not your friend's, and that number may be new.
• A scammer may use a real person's bank account, so the name on the transfer screen can look normal.
• A company name can be borrowed from a genuine business. Check the details against the company's own website, not the chat.
• The portal's own disclaimer says the Government of Malaysia and PDRM are not responsible for any loss from using its information. It is a warning tool, not a clearance.

#When to Run a Check on Social Media

PDRM's FAQ on online purchase scams advises buyers to check the seller's details and the receiving account before paying, and to avoid moving the deal off the platform. These are the moments to stop and search.

#A Pre-Payment Checklist That Goes Beyond Semak Mule

Run through this list before any transfer to someone you met online. One failed item is enough to walk away.

• Semak Mule shows no record for the account, the phone number and, where given, the company name.
• The name on the bank account matches the seller or business, and a business is not asking you to pay into a personal account.
• You confirmed a friend's request by calling a number you already had, not one from the message.
• The price is not far below what everyone else charges, and nobody is rushing you to pay "before someone else does".
• The deal stays on the platform, where its buyer protection and reporting tools still apply.
• Nobody has asked for an OTP, TAC, PIN or password. PDRM's FAQ says these must never be given to anyone, including people claiming to represent an organisation.
• You have screenshots of the profile, the listing or message, and the payment details, with dates visible.

#What Semak Mule Cannot Do

Semak Mule answers one question: does this number, account or company appear in police scam reports. It does not tell you who owns a number, where they live or whether a profile is genuine.

• Do not use a result to track down, name, shame or confront the person behind a number. Report them and let the police and the platform act.
• Do not post screenshots of someone's details as "scammer" in public groups. If you are wrong, the account may belong to an innocent person whose account was misused.
• A record does not freeze money. Only the bank, through its own process and the NSRC, can try to stop a transfer.
• It does not cover crypto wallet addresses or e-wallet usernames unless they come as a phone number or bank account.

#If Your Own Number or Account Shows Up

Sometimes the shock runs the other way: you search your own number or bank account and find a record, or your bank blocks your account. The NSRC's FAQ on the NFCC website says 997 is not the line for a blocked account. It tells you to contact your bank and explain the situation, because the account may be blocked on suspicion of mule use, and to escalate an unresolved complaint through the bank's complaints unit and then Bank Negara Malaysia.

PDRM's FAQ adds that an account owner whose account was used to move criminal money can be called to help an investigation, and that what follows depends on the facts and the owner's role. If you lent your account, card or online banking to someone, or your phone number was taken over, keep every message and seek legal advice. This is general information, not legal advice. A legitimate business that finds its name listed should raise it with PDRM directly, not through anyone selling a "removal".

#Already Paid? Bank, NSRC 997 and a Police Report

Speed matters more than anything else in this article. The NSRC's FAQ says to contact your bank's 24-hour hotline or the NSRC on 997 as soon as you discover the fraud, then make a police report at the nearest station within 24 hours, and to report it even if more time has passed. It is frank that acting quickly can reduce losses, but there is no guarantee you will get your money back.

1. Call your bank's 24-hour hotline (on the back of your card or the bank's website) or 997. Have the receiving account number, amount and time ready.
2. Make a police report at the nearest station. Bring the transfer receipt, the scammer's number and account, the profile link and screenshots of the chat.
3. Report the profile, listing or message on the platform so others are warned.
4. If you typed your bank or social media password into a link the scammer sent, change it from a clean device and turn on two-factor authentication.
5. If the scam involved a fake website or phishing link, you can also report it to CyberSecurity Malaysia's Cyber999, which takes reports by online form, email, phone and its mobile app.

The NSRC's FAQ also says that NSRC, PDRM, MCMC, BNM and banks contact you only after you have made a report, and never ask for your username, password, PIN, TAC or OTP. That matters, because victims are often contacted again by people pretending to get the money back. What 997 does after your call is covered in our guide to the NSRC 997 hotline, and what to take to the station is in our police report checklist.

#When a Case Review Makes Sense

Checking a number and reporting a scam are things you can do alone, for free, and nobody can do them better on your behalf. Outside help is only worth considering when the scam started with your own social media account: it was hacked and used to message friends, or someone took it over after you shared a code. SocialSafe by AwareXone, the recovery service of a Malaysian security company, looks at the case first and tells you honestly whether an official platform route is still open; the platform makes the final decision, and some accounts do not come back. Our account security service explains how we help lock an account down afterwards, and our Trust Center sets out what we will never ask for, starting with your password and login codes.

#Frequently Asked Questions