Scam texts and calls in Malaysia: how to spot fake Pos Malaysia, LHDN, bank and 'NSRC' messages

Scam texts and calls work because they look like the messages we get every day: a parcel update, a tax notice, a fraud check from the bank. The trap is the link, the app or the transfer — a convincing copy of a real website, an APK file dressed up as a wedding invitation, or a 'safe account' that belongs to the scammers. Bank Negara Malaysia puts the reported impact of scams in Malaysia at RM2.8 billion in 2025.

The scams Malaysians see most

• Parcels — a parcel 'held' because of an unclear address or missing details, with a link to update your information. Pos Malaysia lists these among the latest scam tactics.
• LHDN look-alikes — fake tax arrears, fake refund emails, or a fake criminal case followed by a request to move money to a 'safe account', as HASiL describes.
• Macau scams — a caller claims you're under investigation and tells you to transfer your money. Bank Negara Malaysia says authorities such as BNM, LHDN, MCMC and PDRM will not ask you to immediately transfer funds to another account.
• Malicious apps — APK files sent as wedding invitations, calendars and similar, which BNM warns can let your phone be hacked, monitored or tracked.
• Job offers — high pay, no interview and a deposit up front, after which your bank account is used as a mule account. BNM warns that mule account holders face up to seven years in jail and a fine of up to RM100,000.

What the genuine organisations do — and never do

• The Association of Banks in Malaysia says banks will never ask for your card number and CVV, your online banking username and password, or SMS OTP/TAC numbers. A bank may call about a suspicious transaction and check partial details, such as the last four digits of your MyKad number.
• Bank Negara Malaysia says banks no longer send clickable links by SMS, and that banks and authorities will never ask for your IC number, PIN or password over the phone.
• Pos Malaysia says it doesn't make calls about prohibited items, doesn't have special lines connecting to PDRM or Customs, doesn't ask for payment to intermediaries or personal accounts, and doesn't send SMS asking you to update your details through an unknown link.
• Ninja Van says it only contacts recipients through NinjaChat, its verified social media and WhatsApp Business accounts, or its own email addresses.
• HASiL says to pay tax only to HASiL, not to click links or download apps from unofficial sources, and to check that official email comes from the @hasil.gov.my domain.
• The EPF warns that scammers spoof its hotline, 03-8922 6000, as caller ID — so a familiar number on your screen proves nothing.
• The National Scam Response Centre only receives calls on 997 and never contacts anyone by phone or WhatsApp. The police say any call or message claiming to be from the NSRC is a scam.

How to check without tapping the link

1. Don't tap the link, don't install anything and don't call the number in the message.
2. Open your bank's app, MyTax or the courier's own app or website yourself, and look for the same message there.
3. If a caller asks for codes, passwords or a transfer, hang up and call the organisation on its official number — for HASiL, 03-8911 1000.
4. Check a suspicious phone number, bank account or company name on the police's Semak Mule portal (semakmule.rmp.gov.my), as the government's MyGOV portal recommends.
5. Only install apps from Google Play, the App Store or Huawei AppGallery, as Bank Negara Malaysia advises.

Since MCMC directed telcos to block hyperlinks in SMS, scammers have moved to RCS, iMessage, WhatsApp and Telegram, Bernama reported in August 2026 — so a link in a chat app deserves the same suspicion.

If you've already tapped, paid or shared details

1. Call the National Scam Response Centre on 997 straight away. The government's MyGOV portal says to call within 24 hours of discovering the scam, so the authorities can try to block the accounts and transactions involved. The line is open 24 hours a day.
2. Contact your bank and tell it what you shared.
3. Lodge a police report at the nearest police station.
4. Change the password on any account you entered on the fake site — and anywhere else you use the same password — and turn on two-step verification.
5. If you installed an app from a link, uninstall it. Bank Negara Malaysia's advice is to uninstall suspicious apps and use antivirus software.

Can a security app help?

Partly. Bank Negara Malaysia's advice includes using antivirus software, and NACSA recommends keeping your devices protected with updated, original anti-virus software. Several security suites add scam-text, call and link checks on top of what the phone does itself. It's a useful safety net, especially for family members who are less confident online — but no app replaces the habit of checking through the official app or hotline before you pay anything.

The message isn't the scam. The link, the app and the transfer are. Go to the real website or hotline yourself, every time.