The numbers.
Malaysia and the world.

Malaysia

RM2.77 billion lost.
In eleven months.

The official RM2.77B figure captures only reported cases. The RM54B estimate comes from a nationally representative survey (GASA/GfK, 2024) where respondents disclosed losses regardless of whether they filed a police report. Both numbers are real — they measure different parts of the same crisis.

Note on loan scams: Fake loan offers — where victims pay upfront "processing fees" or surrender OTP credentials for a loan that never arrives — are not tracked as a standalone category in PDRM/CCID official statistics. They are absorbed into the phishing/OTP theft and e-commerce figures above. MySPA classifies these separately as Fake Loan Scam.

Job scam surge: The 16% figure above is the share of losses — but the category grew +146% year-on-year in 2025, reaching 8,484 cases and RM202.58M in losses. It is now the fastest-growing scam type in Malaysia. A significant and undercounted subset involves overseas job trafficking: Malaysians recruited via Facebook or Telegram for "customer service" roles that turn out to be forced scam operations in Myanmar or Cambodia.

E-commerce seller targeting: The dominant 2025 marketplace scam targets sellers, not buyers. A scammer poses as an interested buyer on Carousell, Facebook Marketplace, or Mudah.my, then moves the conversation to WhatsApp and sends a fake "payment confirmation" email with a banking phishing link. The seller enters their credentials — and their full account balance is drained. Victims are confused because they were the merchant.

Who Gets Hit

It's not who you think.

Banks catch fraud — unauthorized transactions criminals initiate. Malaysia's crisis is scams — victims authorize the transfer under deception. By the time bank systems activate, the decision is already made.

April 2026: Bank Negara Malaysia fined Bank Rakyat RM1 million for inadequate cybersecurity controls after an external threat actor accessed their IT infrastructure — the first high-profile enforcement action for an institutional breach. Even the banks themselves are targets.

The World

$1 trillion stolen.
In twelve months.

For the first time in recorded history, global scam losses crossed $1 trillion in a single year. The 2024 GASA Global State of Scams report — based on 58,000 respondents worldwide — puts total consumer losses at $1.03 trillion.⁸

Southeast Asia

The largest scam operation
in human history.

Across Myanmar, Cambodia, and Laos, transnational criminal networks have built industrial-scale fraud operations. Workers — many trafficked under false job advertisements — are forced to run scam scripts targeting victims in Malaysia, the US, and across the globe.

The UN High Commissioner for Human Rights has described the scam compound network as a "human rights crisis." These are not opportunistic individual fraudsters — they are vertically integrated criminal enterprises operating at national scale.

The AI Threat

Scams are getting smarter.
Faster than defences.

Artificial intelligence has cut the cost of running a scam by 95% while multiplying its reach. A professional-grade phishing campaign that once required days of expert effort now takes five minutes. Criminal networks are adopting these tools faster than any defensive system can adapt.

Scale of the threat

Documented incidents

Malaysia specifically

Maxis launched an AI firewall in February 2026 that blocked 500M+ fraudulent calls and SMS in 2025. Maxis's own documentation states it does not cover WhatsApp or Telegram — where the majority of Malaysian financial fraud now occurs. The network layer cannot see the conversation layer.

The Reporting Gap

Reporting works.
When it happens in time.

The single most important variable in scam recovery is not the amount lost, or the scam type, or the bank involved. It is how quickly the victim reports.

The scam happens on WhatsApp. The hotline is a phone call. The portal is a website form. Every existing system asks victims to leave the place where the scam happened and navigate a process they don't know exists. MySPA is in WhatsApp — where the scam is.