SIM Swap in Malaysia: No Service, Then Accounts Hacked

Your phone was fine this morning. Now it shows "No service" or only lets you make emergency calls, restarting does nothing, and then the emails start: a password reset you did not ask for, a new login on your Google account, a bank alert. People search for this as "tiba-tiba tiada liputan" or "手机突然没信号", and the fear is the same in every language.

The short answer: treat it as a possible SIM swap until your telco tells you otherwise. Call the telco from another phone, protect your money through your bank or NSRC 997, then take back your email and accounts one by one. Speed matters more than perfect order.

This guide covers how to tell a SIM swap from a bad signal, what to ask your telco, how to stop the money, how to secure each account, and where to report it in Malaysia.

Last checked: 29 September 2026.

#What Should You Do If Your Phone Suddenly Loses Signal and Accounts Get Taken Over?

Borrow a phone, call your telco and ask whether a replacement SIM or eSIM was issued on your number; if it was not you, ask them to block the line. If your bank, e-wallet or card is linked to the number, call your bank's hotline or NSRC on 997 at once. Then secure your email, change passwords on everything that sends codes to that number, switch those accounts to an authenticator app or passkey, and make a police report. Never read out an OTP to anyone who calls you, whoever they say they are.

#Is It a SIM Swap, a Fake Tower or Just a Bad Signal?

A SIM swap means someone has your phone number working on a SIM they control, so your calls and SMS codes go to them. CelcomDigi's own guide to sharing your number for OTPs describes it as criminals impersonating you to get your number moved to a new SIM, then using the codes to get into banking, email and social media. The signs overlap with ordinary problems, and the wording on your screen varies by phone model.

The fake tower row is real in Malaysia. In a media statement on 29 July 2026, MCMC said it had broken up another syndicate using a fake base transceiver station, equipment that imitates a mobile network to push scam SMS with links to nearby phones. MCMC advised the public not to tap suspicious SMS links or share banking details without checking through official channels.

#Step One: Call Your Telco From Another Phone

Use a family member's phone, a work phone or your telco's official online chat. Take the hotline from your bill or the telco's official website, not from an SMS or a search ad.

1. Say that your line stopped working unexpectedly and you suspect a SIM swap.
2. Ask whether a replacement SIM or an eSIM was issued on your number, and when and where.
3. If it was not you, ask them to suspend the line and block the number.
4. Ask what you need to bring to get a replacement SIM in your own name.
5. Write down the date, time and any reference or ticket number.

Maxis's page on losing a phone with an active SIM says the first step is to contact your provider to suspend the service and block the number under the Public Cellular Blocking Service (PCBS). It also says a Maxis SIM replacement is done at a Maxis store with your MyKad for biometric verification, or a passport for foreigners, and that a number registered in your name can be replaced with the same number. Other telcos run their own processes, so ask yours.

In its January 2026 public inquiry report on registering prepaid users, MCMC called unauthorised SIM card replacement "a key fraud risk" and said providers must verify the identity document with biometric authentication or MyDigital ID for a SIM replacement, plus at least one detail about how the line is used. That report covers prepaid services and a transition period, so ask your telco what checks apply to your line today.

#Step Two: If Money Can Move, Call the Bank or NSRC 997

If any bank account, card or e-wallet uses that number, do this immediately after the telco call, or before it if you already see transactions. The NSRC's FAQ on the NFCC website says to call your bank's 24-hour hotline or NSRC on 997 as soon as you notice an unauthorised transaction. It says the bank hotline number is on the back of your card or on the bank's website, and that if you cannot get through to 997, you should call the bank directly.

The same FAQ says to make a police report at the nearest station within 24 hours, after you have called the bank or 997, because the police cannot follow up without one. It is honest that acting quickly reduces losses but does not promise the money comes back.

Ask your bank to suspend online banking while you sort out the number. In a 2022 speech on financial scams, Bank Negara Malaysia's Governor said banks were required to move away from SMS OTP for transfers, payments and account setting changes, to limit customers to one device for approving online banking, and to give customers convenient ways to suspend their accounts if they suspect a compromise. A linked number can still matter for alerts and resets, so tell the bank what happened.

#Step Three: Secure Your Email, Then Every Account Tied to the Number

Your email is the master key. Whoever controls it can reset most of your other accounts, so fix it first, from a device you trust.

For a Google account, Google's page on securing a hacked account says to use the account recovery page if someone changed your password or recovery phone. Once in, it says to review recent security events, check which devices are signed in, correct any recovery phone or email you did not set, and in Gmail remove forwarding rules, filters and delegated access you did not create.

• Change the password on your email, then on each account that used the same password.
• Remove your stolen number as a recovery or 2FA phone until the telco confirms it is back with you.
• Sign out of all other sessions and devices on each account.
• Check recovery email addresses, linked apps and payment methods for anything new.
• Warn close contacts from a channel you still control that messages from your number may not be you.

WhatsApp is tied to the phone number itself, so it needs its own steps once your SIM is back; our guide to a WhatsApp account taken over through a verification code walks through them. For Instagram, Facebook and other platforms where the attacker has already changed the email or phone, our overview of reporting a hacked account in Malaysia lists each platform's official route.

#Step Four: Move Your Logins Off SMS Codes

A SIM swap works because SMS codes follow the number, not the phone in your hand. CelcomDigi's guide recommends authenticator apps such as Google Authenticator instead of SMS codes, because the codes are generated on your device and are not exposed to SIM swap attacks. The platforms say the same thing in their own words.

Google's page on turning on 2-Step Verification also says Google will never call you to verify a code. Facebook's page on how two-factor authentication works lists three methods: a security key, codes from a third-party authentication app, or SMS codes, and suggests creating a passkey. Our guide to two-factor authentication on Instagram, Facebook and TikTok shows where each setting lives.

#Calls and Messages to Ignore While Your Line Is Down

A SIM swap victim is a target for a second scam. You may get calls or emails claiming to be your telco, bank or the police, offering to "restore your line" or "freeze the account" if you press a key, install an app or read out a code.

#Report It: Police, Your Telco, MCMC and Cyber999

Reporting creates the paper trail your bank, telco and platforms may ask for:

1. Police report at the nearest station, especially if money moved or someone used your identity. Bring your telco reference number and screenshots.
2. A formal complaint to your telco if they confirm a SIM was issued without you. Keep the ticket number.
3. If the telco does not resolve it, MCMC's make a complaint page says to contact your service provider first, then the Communications and Multimedia Consumer Forum of Malaysia (CFM), and if you are still not satisfied, lodge it with MCMC through the Consumer Redress Portal.
4. A phishing SMS, fake login page or other computer security incident can be reported to CyberSecurity Malaysia's Cyber999 response centre by online form, email, phone or its app.

#Evidence Checklist for the Telco, Bank and Police

• The time your phone lost signal, as close as you can remember, and where you were.
• Screenshots of password reset emails, login alerts and security notices, with dates visible.
• Bank or e-wallet alerts and a list of transactions you did not make.
• Telco reference numbers, and what the telco told you about the replacement SIM or eSIM.
• Any suspicious SMS, calls or messages you received in the days before, with the sender shown.
• A short timeline in plain sentences: what happened, in order, and what you have done.

#Mistakes That Make a SIM Swap Worse

• Waiting hours for the signal to come back on its own while codes keep going to someone else.
• Resetting social media first and leaving the email account, which can be used to reset everything again.
• Calling a number from an SMS that arrived just after the signal dropped.
• Adding the same number straight back as your 2FA phone before the telco confirms it is yours again.
• Skipping the police report because the loss seems small; banks and platforms may ask for it later.

If the telco confirms nothing changed on your line, the entry point was probably elsewhere, such as a phishing link or a reused password. Codes going to a number you gave up years ago is a different problem, covered in our guide to recycled phone numbers.

#When a Case Review Makes Sense

Most people can work through this alone. The telco controls the line, the bank decides on the money and only each platform can restore its account, so nobody outside them can promise an outcome, and some accounts are not recovered. Outside help is worth it when several accounts were taken at once, or when the attacker changed the email and phone on a business or creator account. SocialSafe by AwareXone, our recovery service, reviews the case before anything is agreed and tells you if you already have what you need. You can read how our account security service works, and our Trust Center explains that we never ask for your password or login codes.

#Frequently Asked Questions