Email spoofing and invoice scams in Malaysia: how to protect your business

Last reviewed: 8 November 2026

Not legal advice. This page is general education, written from public official sources linked below. It is not legal advice and may be out of date. For decisions about your business, check the official source or ask a Malaysian lawyer.

In an invoice or payment scam, a criminal sends an email that looks like it comes from your supplier, your boss or your own company, asking for a payment to a new bank account. Sometimes the email really comes from a hacked mailbox; sometimes the sender address is simply forged. Malaysia's government portal lists procurement fraud and bank or government agency impersonation among the scam types the National Scam Response Centre (NSRC) handles.

Warning signs

A supplier says their bank account has changed, especially by email only.
Urgency or secrecy: “pay today”, “don't tell anyone, the deal is confidential”.
The sender name looks right but the address or domain is slightly different (for example .com instead of .com.my, or a swapped letter).
Replies go to a different address from the one shown.

How to protect your business

Verify every bank-detail change by phone, using a number you already have, not one in the email.
Check the account on PDRM's CCID Semak Mule portal, which lists bank accounts and phone numbers reported in scams. A clean result is not proof of safety.
Turn on multi-factor authentication for every mailbox, so a stolen password is not enough.
Publish SPF, DKIM and DMARC so criminals cannot easily send as your exact domain. Check your domain now, then follow the setup guide.
Require two people to approve new payees or large transfers.

If you have been scammed

Call 997 (NSRC) at once. The official portal says the line runs 24 hours daily and asks victims to call within 24 hours of discovering the scam, so banks can try to freeze the money (malaysia.gov.my).
Call your bank.
Make a police report at the nearest station, as the portal advises.
If a mailbox or computer was hacked, report the incident to MyCERT (Cyber999), which operates from CyberSecurity Malaysia (mycert.org.my), and change passwords with MFA turned on.
If customer or staff personal data was exposed, read our PDPA checklist on breach notification.

FAQ

What is the scam hotline in Malaysia?

997, the National Scam Response Centre. The government portal says it runs 24 hours daily.

Can DMARC stop all invoice scams?

No. DMARC stops criminals sending as your exact domain. It does not stop look-alike domains or emails from a hacked mailbox. Phone verification of bank changes is still essential.

Should we pay if the supplier's email looks genuine?

Not until you have confirmed the bank details by phone on a number you already have.