Scammed online? The first 30 minutes matter most

Step 1: Cut off access before you do anything else

Whatever else is true, the first job is to stop the bleeding. If a scammer has your OTP, your login, or control of your phone through an app you installed, every minute of access is another chance to move money.

Several Malaysian banks now offer a self-service freeze inside the app. Maybank, for example, describes its Kill Switch as a self-service security feature available on the MAE app and Maybank2u web, which lets you protect your funds if you suspect you have been scammed. Other banks have similar features under different names, so check your own app's security menu — or just ask the hotline to do it for you when you call.

If you installed an app from a link or an APK file rather than the official app store, assume the phone itself is compromised. Use a different device to make your calls where you can.

Step 2: Call your bank first — it is the line that always answers

The NFCC, which runs the National Scam Response Centre alongside PDRM, BNM and MCMC, is explicit on this point: your bank's hotline operates 24 hours a day. If you cannot get through to 997, or you have realised at 2am, the bank hotline is the answer.

You can find the number on the back of your bank card or on the bank's own website. The Association of Banks in Malaysia also publishes a directory of bank contacts at abm.org.my/directory.

Don't search for the number. Fake "bank hotline" listings and sponsored search results exist precisely to catch people in this moment. Card, app or official website only.

Step 3: Call 997

NSRC exists to coordinate a rapid response — trying to trace and block stolen funds across banks and telcos before the money moves on. Official NFCC guidance states that 997 can be contacted between 8.00am and 8.00pm every day, including public holidays.

Be ready with the details before you dial. NFCC lists what you will be asked for: a brief chronology of what happened, your own details, the suspect's details, the transaction details, the transaction receipt, any website addresses the criminal sent you, and your communications with them — call logs, SMS, WhatsApp, Telegram and so on.

One thing to be clear-eyed about: NFCC states directly that quick action can help reduce potential losses, although there is no guarantee that you will get your money back. Anyone who tells you otherwise is selling something.

Step 4: Make the police report

NFCC's guidance is that a police report must still be made, within 24 hours, and that if no police report is made, follow-up action cannot be carried out by the police. The order matters too: contact your bank or 997 first, then go to the nearest station.

Bring everything from the evidence list above. You will be given the report, or referred to the PDRM investigating officer assigned to your case.

And if it has already been longer than a day? Report it anyway. NFCC states that even where the incident has been going on for some time — more than 24 hours, for example — you still need to report it to your bank, because that reporting helps the authorities act against the criminals even where your own chances have narrowed.

Step 5: Protect yourself from the second scam

Within hours of a scam, many victims are approached again — by a "bank officer" following up, a "police officer" with good news, or a service promising to recover the funds for a fee. These are the same industry, working the same list.

NFCC gives you two rules that settle it every time. First, the NSRC, PDRM, MCMC, BNM and banking institutions will only contact you if you have already made a report to them. Second, none of them will ever ask for your personal banking information — username, password, PIN, TAC or OTP.

So: unexpected contact, or any request for those credentials, means it is not them. Don't simply click, don't read out a code, and hang up if you need to. See our scams section for how these follow-up approaches are usually scripted.

What happens next

997 is an emergency line, not a case-management line. NFCC states plainly that it is not a contact centre for case follow-up. To check on your case, contact the PDRM investigating officer assigned to it, or the Commercial Crime Investigation Department office at the relevant district police headquarters.

If your account gets blocked

Sometimes the account that gets frozen is yours — often because it is suspected of having been used by criminals as a mule account, according to NFCC. Don't call 997 about this; it is a bank matter. Contact your bank and explain what actually happened. Our page on mule accounts explains how ordinary people end up in that position.

If your bank's handling goes nowhere

Complaints go to your bank's complaints unit first — the details are in BNM's financial service provider directory. NFCC notes that if you remain dissatisfied with the complaint unit's response, you can take the matter to BNM TELELINK.