A payment can be approved by the account holder and still be a scam. That is the uncomfortable detail behind Bank Negara Malaysia's latest update: about 95% of fraud and scam cases in Malaysia involve transactions that victims were manipulated into authorising.
BNM assistant governor Dr Norhana Endut shared that figure in Bangkok on 14 October, according to Bernama. She also said the National Fraud Portal had cut the time needed to trace funds by 75%.
Faster tracing gives banks a better chance to follow money as it moves. For the person who has just pressed “confirm”, though, the useful response starts with a call to the bank, rather than another conversation with the person who requested the transfer.
A convincing story can get past the payment screen
Norhana described increasingly sophisticated, personalised scams, while instant payments have shortened the time available to intervene. The portal supports coordinated reporting, tracing and recovery across financial institutions and payment networks.
Those are improvements in the response system. The 75% figure refers to the time needed for tracing; it does not mean 75% of stolen money is recovered, or that every victim receives a refund.
The high share of authorised transactions also explains why checking a balance or recognising the banking app is not the whole task. A real payment can be made for a false reason. The deception may happen before the bank sees the instruction.
The caller's name is not proof
The US Federal Trade Commission describes impersonation as a common starting point: a scammer borrows the identity of a government office, familiar company, utility or charity. Technology can also change the name and number shown on caller ID.
That means the reassuring detail on the screen may be part of the trick. Someone knowing the name of a company you use does not establish that the company sent them. A familiar-looking number does not establish who is speaking.
The FTC recommends contacting a company through a website or telephone number you already know is genuine. Use that independent route instead of a number supplied in an unexpected message. This is general scam-prevention guidance; US reporting channels and legal protections are different from Malaysia's.
Urgency is doing a job for the scammer
Another pattern the FTC identifies is pressure to act immediately. The caller may describe an account problem, a threat of punishment, a family emergency or a prize that requires a fee. Some insist that the person stay on the line.
The effect is to keep the target inside one version of events. There is less room to check the claim, look up the organisation separately or ask somebody else what they think.
The FTC's practical advice is to stop and speak to someone trusted before paying or giving out personal information. A friend, relative or neighbour does not need to be a cybersecurity specialist to help interrupt a rushed decision.
For a household, that is a useful conversation to have before an alarming call arrives. Agree that an urgent demand involving money can be checked with another person. Asking for a second opinion should feel ordinary, rather than embarrassing.
Watch the payment method, as well as the promise
The FTC also flags demands for particular payment methods. These include cryptocurrency, wire-transfer services and gift cards, especially requests for the numbers printed on a card. Another scheme involves depositing a cheque and sending some of the money onwards before discovering that the cheque is fake.
The precise payment products differ between countries. The underlying question travels well: why is an unexpected caller controlling both the story and the way you must pay?
A payment instruction deserves its own check even when the first part of the conversation sounds believable. Do not let a convincing explanation stand in for verifying the recipient and the organisation independently.
If money has moved, report it straight away
Malaysia's National Anti-Financial Crime Centre advises victims to contact their bank's dedicated hotline or NSRC on 997 immediately, then make a police report. Its guidance covers both transfers made without the account holder's knowledge and transfers that a victim was tricked into making.
The centre also says a prompt report can reduce losses without guaranteeing recovery. Do not assume the situation is beyond reporting simply because you approved the transaction yourself.
Have the transaction receipt, amount, time, account details, suspicious website address and communications ready. Call logs and screenshots can help explain what happened. Give those details through the genuine reporting channel, rather than to someone offering unsolicited help.
If 997 cannot be reached, the bank's hotline is another immediate route. NFCC says bank hotlines operate around the clock, with contact details available on the back of a bank card or the bank's own website.
Follow the money and secure the account
The FTC's recovery guidance distinguishes the payment from any access the scammer obtained. Someone who paid through a bank, card issuer or payment service should contact that provider immediately, explain the fraud and ask what reversal or refund options exist.
That is a request for help, not a promise that a particular payment can be reversed. The provider needs to examine the transaction and its circumstances.
If login details were handed over as well, the FTC advises changing the affected password, changing it on other accounts where it was reused, and enabling two-factor authentication. If access has been lost, use the service's account-recovery process.
If a scammer gained access to a phone or computer, the same guidance recommends updating security software, scanning for harmful software and seeking help from a manufacturer or trusted support provider when needed. Paying the supposed helper who contacted you unexpectedly risks handing the problem to another stranger.
Malaysia's faster tracing system is welcome news. The step a reader can take immediately is still concrete: break contact with the person directing the payment, reach the bank independently and report what happened while the details are close at hand.
Sources & further reading
Prepared with AI assistance from linked reporting. The cover is an AI-generated editorial illustration. Spotted something we should correct?