Scammed Online in Malaysia? How to Try to Recover Your Money

What should you do in the first 24 hours after a scam?

Act within minutes, not days, because scammers move money through several layers of accounts very quickly.

1. Call the National Scam Response Centre (NSRC) on 997. It is staffed by police officers together with bank and telecommunications staff, who can trace and try to freeze the transfers. Have the date, time, amount and recipient account numbers ready.
2. Call your bank's 24-hour fraud hotline, and use the kill switch in your banking app or the hotline to suspend your account if your login, card or phone may be compromised.
3. Lodge a police report at a police station, or confirm that your report has been recorded, and keep the report number. Banks and courts will ask for it.
4. Keep everything: screenshots of chats, profiles, advertisements, websites, payment receipts, bank statements and phone numbers. Save the chat before you block the scammer.
5. Change your passwords and remove any app you were asked to install.

In one case described by the government in March 2026, a victim lost more than RM800,000 from 2pm but only reported it at about 10pm, and about RM170,000 was recovered. Another victim who called at once recovered nearly everything.

Ignore anyone who offers to recover your money for a fee. Recovery scams target people who have just been scammed.

Can the money be frozen, and how is it returned?

Yes, if it is caught in time. Once you report, the NSRC and the banks use the National Fraud Portal to trace the money across accounts and freeze what remains in them. Under section 116D of the Criminal Procedure Code (Act 593), added in 2024, a police officer of the rank of sergeant or above can seize or block transactions in an account suspected of being linked to the offence.

The results show both the value of acting quickly and its limits. According to figures given in Parliament in January 2026, in 2025:

A freeze is not the same as a refund. Frozen money may belong to several victims, or be mixed with the account holder's own money, and it is released only after the investigation, sometimes after a court order. Expect the process to take months.

If money is frozen, give the investigating officer your full transaction records and ask what is needed for release.

Will your bank or e-wallet provider compensate you?

Possibly, depending on whether the transaction was unauthorised and whether the bank's safeguards failed. Bank Negara Malaysia has stated that banks bear the full loss of unauthorised transactions caused solely by lapses in their security controls. Where both the bank and the customer were negligent, the loss is shared according to each party's responsibility.

In July 2026, the Prime Minister told Parliament that e-wallet providers that fail to implement Bank Negara's preventive measures must fully compensate scam victims within seven working days. The measures include cooling-off periods for high-risk transactions, device binding and the kill switch.

The position is harder if you transferred the money yourself, for example to a fake investment. That is usually treated as an authorised payment, and compensation depends on showing that the bank missed obvious warning signs.

Courts have found banks liable in some cases:

• In Chan Yan Li v Maybank (Kuala Lumpur Sessions Court, May 2026), the bank was ordered to pay RM166,000 after transfers out of a rarely used account were not properly monitored and some were made without alerts.
• In Nemonia Investments Ltd v AmBank Islamic Berhad (High Court, 2023), a receiving bank was liable for RM315,000 withdrawn after it had been notified that the transfer was fraudulent.

Complain to your bank in writing first. If you disagree with its decision, you can ask the Financial Markets Ombudsman Service, which is free for consumers, to review it.

Can you sue the mule account holders?

Yes. A person whose account received your money can be sued to return it, even if they say they only rented out their account. The usual claims are for money had and received or unjust enrichment, and, where the holder knew or should have known the money was stolen, for knowingly receiving or assisting in a breach of trust.

Mule accounts are also a crime. The Penal Code (Amendment) Act 2024 added sections 424A to 424C to the Penal Code (Act 574), in force since late 2024:

Account holders can often be identified from bank records and the police investigation, and the court can order a bank to disclose account details. An urgent freezing injunction may stop assets being moved.

The practical difficulty is that many mule account holders have little money. Before suing, check whether there is anything to recover, so that legal costs do not exceed the likely return.

What is a compensation order under section 426 CPC?

It is an order made by a criminal court, after it convicts a person, that the offender pay compensation to the victim. Section 426 of the Criminal Procedure Code allows the court to make the order in addition to the sentence, so the victim does not need to start a separate civil case for that amount.

In April 2026, the Attorney General directed deputy public prosecutors to apply for compensation orders for victims of crime. A victim may also give a victim impact statement under section 183A of the Code after a conviction.

A compensation order has clear limits:

• it is only possible if someone is charged and convicted in Malaysia, and the organisers of many scams operate from abroad;
• the person convicted may be a mule account holder who received only part of your money;
• the court considers the offender's means, and an order is only worth what the offender can pay; and
• it does not stop you from bringing a civil claim for the rest of your loss.

Make sure the prosecution has your exact losses and documents. A lawyer can hold a watching brief for you at the trial, with the court's permission, and raise the question of compensation. See our criminal litigation page for how the litigation team assists victims.

What are your realistic chances of recovery?

The honest answer is that full recovery is the exception, and the chance falls sharply with time. The table below gives a general guide.

For larger losses, pursue the routes together: follow up the police investigation, use the bank's complaint process, and assess a civil claim against identified account holders. Keep one file of every report and reference number.

If your own account has been frozen because scam money passed through it, the issues are different; see our article on a bank account frozen under AMLA. NZSK can review your documents at a consultation and advise on the options that fit your loss.