The message is friendly, the returns are specific, and there is a deadline. The Securities Commission’s own example of what these pitches look like fits on one line: “Invest RM200 and get RM10,000 within 24 hours”. Real ones are rarely that crude. Spotting an investment scam in Malaysia is less about a gut feeling than about four checks, done in the right order, before any money moves — and, if it already has, about which call to make first.
Tak payah rush. The pressure is part of the pitch, and both regulators name urgency as a red flag in its own right. What follows comes from the Securities Commission Malaysia, Bank Negara Malaysia, the National Anti-Financial Crime Centre and the police, all read on 23 September 2026. Where those official pages disagree with each other — and on one detail that matters in the first hour, they do — both versions are printed.
Quick Answer: look for the licence before you look for the warning. The SC’s Investment Checker and BNM’s Financial Sector Participants Directory tell you who is authorised; the two alert lists only tell you who has already been flagged, and both say plainly that a missing name is no proof of a licence. Then check the bank account you are being asked to pay into. If money has already gone, stop paying, call your bank’s 24-hour hotline or 997 straight away, and make a police report at a station.
- The order that matters: licence, then alert lists, then the payee account. Reverse it and a clean alert-list search starts to look like a green light, which it is not.
- The detail official pages disagree on: 997’s hours. Two sources say 8am to 8pm; two say 24 hours. Call it anyway — and if nobody answers, your bank’s own hotline runs 24 hours a day.
- The line not to cross: paying more to get money back. The SC treats extra “tax” and fees as part of the scam, and its advice to victims is to make no further payments.
Table of Contents
Check licenceCheck accountAlready paid?Two kinds of list, and why the order matters
Malaysia’s regulators publish two very different kinds of list. One kind is a register of who is allowed: the SC’s Investment Checker and Public Register for capital market products, and BNM’s Financial Sector Participants Directory for the institutions it licenses or approves. The other kind is a list of who has been flagged: the SC’s Investor Alert List and BNM’s Financial Consumer Alert List.
The alert lists are useful, but their own small print limits what they can tell you. The SC says its list “is not exhaustive and is based on the information available to the SC at the time of publication.” BNM is blunter: “The absence or subsequent removal of an entity or a scheme from the FCA List however should not be construed as confirmation that such entity or scheme is or has been licensed or regulated by BNM.” A scheme that started last week can be on neither list. A licence, on the other hand, is either on the register or it is not.
So the order is: who should license this, is it licensed, has it been flagged, and whose account is the money going to. The table puts the sequence on one page.
| Check | Run by | What a match tells you | What no match tells you |
|---|---|---|---|
| Investment Checker and Public Register | Securities Commission Malaysia | Check which category it matched under — the register also lists an “Unauthorised” category, so a hit is authorisation only if the category and listed activities match what you are being sold | Only that you have not found an SC authorisation to offer, promote or sell capital market products |
| Financial Sector Participants Directory | Bank Negara Malaysia | The institution is licensed or approved by BNM, in the category shown | For deposit-taking, BNM says a business it does not display “isn’t licensed”; otherwise the activity may simply sit with another regulator |
| Investor Alert List | Securities Commission Malaysia | The SC has named it unauthorised, or a “potential clone” of a real firm | Nothing — the list “is not exhaustive” |
| Financial Consumer Alert List | Bank Negara Malaysia | BNM has identified it as not authorised to offer products or services BNM regulates | Nothing — absence is not “confirmation” of a licence |
| Semak Mule | PDRM Commercial Crime Investigation Department | The bank account, phone number or company name appears in a police report | Only that no report names it yet — the search is titled “Check Accounts with Reports” |
First: who is supposed to license this?
Before any search, work out what you are actually being offered, because each regulator only answers for its own patch. The SC’s complaints page spells out what it does not cover and where those matters go instead, and its scam page carries a second table showing which authority takes which kind of scam report. Put together, the routing looks like this.
| What the offer or scam involves | Where the SC’s pages send it |
|---|---|
| Investment scams involving capital market products | The police, the SC and Bursa Malaysia |
| Deposit taking, forex, banking, credit cards, insurance | Bank Negara Malaysia — and the police, for deposit-taking and forex scams |
| Loan scams, mule accounts, ATM card rentals | Bank Negara Malaysia and the police |
| Multi-level marketing, referral schemes, direct selling, e-commerce scams | The Ministry of Domestic Trade and Cost of Living (KPDN) and the police |
| Interest schemes, shares in private companies | The Companies Commission of Malaysia (SSM) |
| Activities related to co-operatives | The Co-operative Societies Commission (SKM) |
| Someone impersonating a bank or an authority | The police, Bank Negara Malaysia, the SC and Bursa Malaysia |
| Job scams, love scams, cryptocurrency mining and other cheating | The police |
Two statutory lines explain why this step comes first. For capital market products, carrying on a business in a regulated activity without a Capital Markets Services Licence or registration is an offence under section 58 of the Capital Markets and Services Act 2007, punishable by a fine of up to RM10 million, up to 10 years’ imprisonment, or both. For deposits, BNM’s illegal deposit-taking page puts it this way: “Under Section 137(1) of the FSA, it is an offence for any person to accept deposits without a licence” — deposits there meaning money or precious metal taken on a promise of a return, with exceptions such as a car booking fee or a house rental deposit.
If the pitch is currency trading, one more line is worth reading first. BNM’s foreign exchange FAQ, updated 3 September 2025, asks whether a resident individual can buy or sell foreign currency from or to any non-resident, and answers: “No. A resident may only buy or sell FC with licensed onshore banks and licensed money changers.” Whether a particular trading offer falls on the wrong side of that is BNM’s question to answer, and the SC’s table sends forex complaints to BNM and the police. The wider rules on moving money abroad are in Sending Money Overseas From Malaysia 2026: BNM’s Rules.
Look for the licence, not for the warning
The SC’s Investment Checker — Semak Sebelum Labur, check before you invest — “allows you to verify if an individual or entity is authorised by the SC to offer, promote, or sell any capital market products and services in Malaysia.” It searches by individual or entity, and its filters cover licensed entities and representatives, registered persons, marketing representatives, financial planners, registered market operators, and a category labelled Unauthorised. Behind it sits the Public Register, which the SC publishes under sections 77 and 79 of the Capital Markets and Services Act 2007 “to enable the public to ascertain whether he is dealing with a licensed or registered person in relation to any regulated activity.”
A match is only half the answer: a real name is exactly what a clone borrows. The SC’s InvestSmart initiative describes clone firms as “individuals or organizations impersonating legitimate investment firms licensed by the Securities Commission Malaysia”, using “names and logos that closely resemble those of legitimate firms”, and asking for payment into unrelated bank accounts. So finding the name on the register is not the end of the check: the money still has to go to that firm’s own official account, which is the subject of the section after next.
For platforms — equity crowdfunding, peer-to-peer financing and digital asset exchanges — the SC registers operators as Recognised Market Operators and lists them on its Digital Initiatives page, and the Investment Checker has a Registered Market Operators filter.
BNM’s equivalent is its Financial Sector Participants Directory. If the offer is to take your money as a deposit — a return promised for leaving money with someone — BNM’s own test is short: “All licensed institutions are displayed on our website… If you can’t find their business on our website, it means it isn’t licensed. Do not transact with them!” For anything else, BNM warns that an entity missing from its directory “does not necessarily come under our purview”, which is why the first step was working out whose patch the offer falls in.
When neither register settles it, ask: the SC on 03-6204 8999 or [email protected], BNM’s BNMLINK on 1-300-88-5465 (Monday to Friday, 9am to 5pm).
Then read the alert lists, and their small print
The SC’s Investor Alert List “contains the names of unauthorised entities and individuals”, and the SC updates it periodically with unauthorised websites, investment products, companies and individuals. Its instruction for any name on it is direct: “You are advised not to deal with or invest through them.” It also spells out the consequence: “If you invest through unauthorised entities and individuals, you will not be protected under Malaysian securities laws.” Entries marked “potential clone” are ones that may be impersonating a legitimate firm.
BNM’s Financial Consumer Alert List is “a guide to enhance the awareness on entities or schemes which may have been wrongly perceived or represented as being licensed or regulated by” BNM. It is updated from reports by the public after BNM has assessed them, and each entry shows the name, any website, and the date it was added. BNM uses the same “potential clone entity” label for entities that may copy a legitimate organisation’s business name, logo and registration details.
Names are the easiest thing for a scheme to change, so neither regulator treats a clean search as clearance — BNM calls its list “one of several ways to check”, and the SC says its own “only serves as a guide”. It is also why this guide does not reproduce a single name from either list: the lists move, and a copy is out of date as soon as it is made. Search the live list at the source.
Check the account before you pay into it
The SC’s rule on where investment money goes is one of its ‘12 Ways to Protect Yourself’, and it is the single most useful check before paying: “Never deposit your money into a personal bank account or bank account of an unrelated entity”, and payments for investment “should only be made to the official bank accounts of” firms licensed or registered by the SC. A request to pay a personal account is also on the SC’s list of scam characteristics.
The same SC list tells you to “check PDRM’s ‘Semak Mule’ portal to verify whether the bank accounts and telephone numbers have been reported to the police.” Semak Mule is run by the police’s Commercial Crime Investigation Department (JSJK, or CCID) and searches three categories: bank account number, telephone number and company name. PDRM also points the public to its own ‘Semak Mule CCID’ app. The portal’s search is titled “Check Accounts with Reports”: it checks against reports already made, so a clean result on a brand-new account means only that nobody has reported it yet. Its disclaimer adds that the Government and PDRM are not responsible for any loss or damage from using its information.
A related trap sits on the other side of the transfer. BNM describes a mule account as one where “your bank account is being used by others to either collect or transfer funds”, and lists the usual approaches: offers to ‘rent’ your account, well-paid jobs that want your ATM card or online banking details, and unlicensed lenders who take an ATM card as collateral. The consequences it lists fall on the account holder — the account may be closed, opening one later may be difficult, and there is a risk of being charged with facilitating criminal activities. BNM’s advice is not to let anyone access your account, even in exchange for money.
The red flags, in the regulators’ own words
The SC keeps a list of ten characteristics of current investment scams; BNM lists warning signs for illegal deposit-taking; the SC’s InvestSmart initiative adds a few more. They overlap heavily, which is itself worth noticing. The table keeps each regulator’s wording and says whose it is.
| Red flag | Who says so |
|---|---|
| High returns with little or no risk in a short time — the SC’s example is “Invest RM200 and get RM10,000 within 24 hours” | SC; BNM warns about “guaranteed returns” or returns higher than usual without much risk |
| Tiered packages such as “Basic, Silver, Gold and Platinum” promising risk-free returns | SC’s InvestSmart |
| Payment into a personal bank account or the account of an unrelated entity | SC; InvestSmart, on clone firms |
| “Limited Time Only”, “once in a lifetime deal” and other pressure to act now | SC and InvestSmart; BNM calls a false sense of urgency “a red flag” |
| More money demanded as tax, “processing fees” or a “currency conversion fee” | SC; InvestSmart calls it an “advance fee” |
| Marketed through social media and messaging platforms | SC |
| Fake testimonies, and celebrity or prominent-personality endorsements | SC |
| Certificates, letters, invoices or receipts said to come from the SC, the Companies Commission, BNM or LHDN | SC; BNM, on letters claiming BNM approval |
| Names, logos and websites copied from real licensed firms | SC; BNM’s “potential clone entity” label |
| Dressed up as “Shariah-compliant” | SC |
| No receipts, no proper documentation | BNM |
| Defensive answers when you raise doubts | SC’s InvestSmart |
Every row describes behaviour, not a product, which is why the list still works when the product names change. The rest of the SC’s ‘12 Ways to Protect Yourself’ points the same way: don’t be pressured or rushed, be sceptical of any opportunity that is not in writing, and keep your MyKad number and bank details to yourself.
When “the regulator” is the one asking for money
Some scams skip the investment pitch and go straight to fear. On 8 May 2025 the SC warned about callers claiming that people were “under investigation” by the SC for market offences, then pressuring them to pay a “guarantee deposit” — purportedly up to RM500,000 — to avoid arrest or prosecution. The SC’s answer is a single sentence worth remembering: “As a regulatory body, the SC does not endorse any investment schemes, solicit monies from the public or demand deposits in any form for regulatory investigations.”
The NFCC sets a similar rule for everyone involved in scam response: the NSRC, PDRM, MCMC, BNM and banks “will only contact you if you have already made a fraud incident report to them”, and will never ask for your username, password, PIN, TAC or OTP. BNM lists misuse of its own name and logo, including letters or certificates claiming BNM approval, as a warning sign, and the SC treats misuse of its logo or misrepresenting the SC as a matter to report to it.
The same goes for anyone offering, after a loss, to get the money back. The SC’s advice to victims is to “cancel future transactions” and not to make “any further payments with the hope that you will get your money back”, and its list of scam characteristics includes getting victims “to part with more money in the pretext of income tax payment and miscellaneous fees”.
Already paid? The first hours
If money has already left your account, the official sources agree on the order even where they differ on detail: stop paying, call your bank or 997, then go to a police station. The SC’s own steps begin with “Do not panic”, then cancelling future transactions and keeping records of everything about the investment.
The National Scam Response Centre, announced on 14 October 2022, is a joint operation of the NFCC, PDRM, BNM, MCMC, banks and telcos coordinating rapid response to online financial fraud. Its remit covers money moved without your knowledge and cases where you were “tricked into transferring” money through an online financial service, and the MyGOV portal lists investment scams among the types it takes. BNM’s instruction is to “immediately call your bank’s scam hotline, or the National Scam Response Centre (NSRC) at 997”, and to lodge a police report.
On 997’s hours, the official pages do not agree:
| Official source | What it says about 997 | Date on the page |
|---|---|---|
| NFCC’s NSRC FAQ | Can be contacted “between 8.00am and 8.00pm every day, including public holidays” | A site-wide stamp of 10 August 2026, identical on every NFCC page |
| BNM scams FAQ and BNM’s NSRC infographic | Calls “must be made within 24 hours of the scam incident and within its operating hours (8am-8pm including weekends and public holidays)” | None shown |
| MyGOV portal | “Daily (24 hours)”; call “within 24 hours of discovering that you have been scammed” | Updated 31/7/2026 |
| PDRM scam-alert posts | NSRC operates “24 jam setiap hari” (24 hours every day) and “24/7 termasuk cuti umum” (including public holidays) | Posts dated 26 May 2026 and 1 March 2026 |
Acting on this needs no ruling on which page is current. Call 997 whatever the time. If it does not answer, the NFCC’s own FAQ says to call your bank’s hotline, “which operates 24 hours a day”; the number is on the back of your bank card or on the bank’s website, and BNM’s Financial Fraud Alerts page carries a table of banks’ scam hotlines.
The 24-hour mark itself is counted from different starting points — BNM says within 24 hours “of the scam incident”, MyGOV says “of discovering that you have been scammed”. Either way, a late discovery is still worth reporting. The NFCC says that even if more than 24 hours have passed, “you still need to report the fraud to your bank”, while warning that the NSRC “may not be able to provide a quick response in such situations as the chances of getting your money back are slim.”
Then the police report. The NFCC advises calling your bank or the NSRC first and then making a report “at the nearest police station”; its English FAQ says to go within 24 hours, and both language versions say reports must be made within 24 hours: “If no police report is made, follow-up action cannot be carried out by the police.” The report cannot be made through PDRM’s e-Reporting, which is only for lost documents or items not related to crime.
If the loss came from a phishing link rather than an investment pitch — an account or e-wallet emptied without you sending anything — the same first calls apply; that pattern is covered in Touch ‘n Go eWallet Scam: How It Works & How to Stay Safe.
Who does what after that
After the first calls, different bodies do different jobs, and 997 in particular is “not a point of contact for complaints” and “not a contact center for case follow-up”.
| Channel | What it is for | How to reach it |
|---|---|---|
| Your bank’s 24-hour hotline | Money that has just left your account; later, complaints about the bank go to its complaints unit | The number on the back of your bank card, or the bank’s website |
| NSRC 997 | Emergency response to online financial fraud, coordinating police, banks and telcos — not complaints, not follow-up | 997; hours as printed in the table above |
| Police station | The police report and the investigation; follow-up through the investigating officer or the JSJK office at district police headquarters | The nearest station — e-Reporting is only for losses not related to crime |
| SC Consumer & Investor Office | Unlicensed capital market activity, illegal schemes and scams, misuse of the SC’s name | [email protected]; 03-6204 8999, 9am to 6pm, Monday to Friday; no walk-ins without an appointment |
| BNMLINK | Deposit-taking, forex, banking and insurance matters, and complaints a bank’s complaints unit did not resolve | 1-300-88-5465, Monday to Friday, 9am to 5pm; the e-LINK online form |
| KPDN e-Aduan | Multi-level marketing, referral schemes, direct selling and e-commerce scams | The e-Aduan portal; hotline 1800-886-800 |
| FMOS | Disputes with a financial institution that is an FMOS member, up to RM250,000, after that institution’s final decision | Within 6 months of receiving the member’s final decision |
The SC does not accept walk-in complainants; its editable PDF Complaint Form goes by email to [email protected] or by post to its Consumer & Investor Office at No. 3 Persiaran Bukit Kiara, 50490 Kuala Lumpur.
FMOS needs one caution. It handles disputes over products and services “provided by our Members”, so it is a route for a complaint about how your own bank or a licensed firm dealt with you — an unauthorised transaction, for instance — and not a route to whoever ran the scheme. It also excludes disputes about how an investment performed, other than non-disclosure, misrepresentation or mis-selling by the member. The SC’s complaints page still sends disputes with licensed intermediaries to SIDREC, which was consolidated with the Ombudsman for Financial Services into FMOS on 1 January 2025.
What to bring, and what to expect
For the bank, 997 or the police, the NFCC lists what to have ready: a short chronology of what happened; your name, phone number, IC number and bank account number; the suspect’s name and phone number with the date and time; the transaction details — the accounts involved, the amount and the time; the transaction receipt; any website address the criminals shared; and your communications with them. It adds that you should be ready to give PDRM evidence such as screenshots of conversations, links, and copies of cash deposit machine receipts.
For an SC complaint about a scam, illegal scheme or unlicensed activity, the SC asks for: how you found out about the scheme; the names, phone numbers and emails of the people offering it; the bank name, account number and account holder you were asked to pay; the website or social media account; screenshots of the posts; receipts and promotional material; and information on any other victims. Send copies, not originals. You can complain anonymously, though the SC says that may limit its ability to investigate, and it keeps your identity secret under section 140 of the Securities Commission Malaysia Act 1993.
The SC sends an acknowledgement with a reference number, but “not all matters complained about will result in an enforcement action”, and it will not tell you the outcome of its assessment, because it is “restrained by law from disclosing information obtained during the performance of our regulatory functions.” It cannot act as your legal adviser or be involved in private civil disputes, and its decision “does not affect your private right to take your own legal action” — a question for a lawyer. Criminal follow-up goes through the investigating officer assigned to your report.
On getting money back, the NFCC’s wording is as far as any official source read for this guide goes: acting quickly “can help you reduce potential losses, although there is no guarantee that you will get your money back.”
Walaoeh Verdict
Treat every offer as unlicensed until a register says otherwise, and treat a clean alert-list search as silence, not approval. The order is licence, alert lists, payee account — the step people skip is the step these schemes depend on. If money has already moved, speed matters more than anything else: your bank or 997 first, a police report at a station within 24 hours, then the regulator whose patch it is. And not one more ringgit to anyone who says a fee will get the rest back.
Frequently Asked Questions
If a company is not on the SC or BNM alert list, does that mean it is safe?
No. The SC says its Investor Alert List “is not exhaustive and is based on the information available to the SC at the time of publication”, and BNM says the absence of an entity from its Financial Consumer Alert List “should not be construed as confirmation” that it is licensed or regulated. The positive check is the licence itself: the SC’s Investment Checker and Public Register for capital market products, and BNM’s Financial Sector Participants Directory for institutions BNM licenses or approves.
Is the NSRC 997 hotline open 24 hours?
Official sources disagree. The NFCC’s NSRC FAQ and BNM’s scams FAQ both give 8am to 8pm, every day including public holidays. The MyGOV portal, marked updated 31/7/2026, says “Daily (24 hours)”, and PDRM’s scam-alert posts from 2026 say 24 hours every day. Call 997 whatever the time; if nobody answers, the NFCC says to call your bank’s own hotline, which operates 24 hours a day and is printed on the back of your bank card.
Can I make the police report online?
Not for a scam. PDRM’s e-Reporting is for lost documents or items not related to crime. The NFCC says to make the report at the nearest police station, after first calling your bank or 997, and that reports must be made within 24 hours: “If no police report is made, follow-up action cannot be carried out by the police.”
Someone says they are from the SC and I must pay a deposit to clear an investigation. Is that real?
The SC warned about exactly this pattern on 8 May 2025: people told they were “under investigation” and pressured to pay a “guarantee deposit”, purportedly up to RM500,000. The SC’s position is that it does not endorse any investment schemes, solicit monies from the public or demand deposits in any form for regulatory investigations. It asks anyone who receives such a request to contact its Consumer and Investor Office on 03-6204 8999 or at [email protected] to verify or report it.
Will I get my money back if I report quickly?
None of the official sources read for this guide promises that. The NFCC says acting quickly “can help you reduce potential losses, although there is no guarantee that you will get your money back”, and that after more than 24 hours the chances are slim, though you should still report to your bank. The SC cannot be involved in private civil disputes; its decision does not affect your private right to take your own legal action.
Sources
Every figure and quotation above comes from one of these, all read on 23 September 2026.
- Securities Commission Malaysia — Investment Checker, Licensed and Registered Persons (Public Register), Investor Alert List and Digital Initiatives (Recognised Market Operators).
- Securities Commission Malaysia — Beware of Scams, Capital Market Service Related Complaints, and the media release of 8 May 2025 on the fake guarantee deposit scam.
- Securities Commission Malaysia — Capital Markets and Services Act 2007, consolidated text in force from 1 January 2026, section 58 only.
- InvestSmart, an initiative of the Securities Commission Malaysia — Learn About Scams and Clone Firm Scams.
- Bank Negara Malaysia — Financial Consumer Alert List, Financial Sector Participants Directory, FAQs: Financial Scams, Financial Fraud Alerts, Illegal Deposit Taking, Mule Account and BNMLINK.
- Bank Negara Malaysia — FAQ on Buying and Selling of Foreign Exchange by Resident, updated 3 September 2025, question 7 only.
- National Anti-Financial Crime Centre — About NSRC and the NSRC FAQ (English), and its Malay version.
- MyGOV — NSRC 997 Hotline, marked updated 31/7/2026.
- Royal Malaysia Police — Scam Alert, Semak Mule and e-Reporting.
- KPDN — e-Aduan complaint portal.
- Financial Markets Ombudsman Service — Our Scope and Who We Are.
About this guide. Written by an independent Malaysian and re-checked against official sources on a schedule — here, the Securities Commission Malaysia’s and Bank Negara Malaysia’s own scam, licensing and complaint pages, the NFCC’s guidance on the National Scam Response Centre, the MyGOV portal and the police. It explains how to check an offer and where to report one; it is not legal, financial or investment advice, and it does not say whether any particular company or scheme is lawful — that is for the regulators and the courts. No company, platform or app is named anywhere above, and no name from either alert list is reproduced, by design: search the live lists at the source. Where official pages disagree, including on 997’s hours, both versions are printed. If you have already paid, call your bank’s 24-hour hotline or 997 first, then make a police report.