Email spoofing and invoice scams in Malaysia: how to protect your business

Last reviewed: 8 November 2026

Not legal advice. This page is general education, written from public official sources linked below. It is not legal advice and may be out of date. For decisions about your business, check the official source or ask a Malaysian lawyer.

In an invoice or payment scam, a criminal sends an email that looks like it comes from your supplier, your boss or your own company, asking for a payment to a new bank account. Sometimes the email really comes from a hacked mailbox; sometimes the sender address is simply forged. Malaysia's government portal lists procurement fraud and bank or government agency impersonation among the scam types the National Scam Response Centre (NSRC) handles.

How a bank-change scam works, and where to stop itEach step is a chance to stop the money leaving.

1. The scammer gets a way inThey break into a real mailbox, or forge the sender address.
Stop it: MFA on every mailbox, and SPF, DKIM and DMARC on your domain.
2. A fake request arrives“Our bank account has changed. Please pay today.”
Stop it: Call the supplier on a number you already have.
3. Someone makes the paymentTo the new account in the email.
Stop it: Two people approve new payees. Check the account on Semak Mule.
4. The money moves onThe longer you wait, the harder it is for banks to freeze it.
Stop it: Call 997 at once, so banks can try to freeze it.

Warning signs

A supplier says their bank account has changed, especially by email only.
Urgency or secrecy: “pay today”, “don't tell anyone, the deal is confidential”.
The sender name looks right but the address or domain is slightly different (for example .com instead of .com.my, or a swapped letter).
Replies go to a different address from the one shown.

How to protect your business

Verify every bank-detail change by phone, using a number you already have, not one in the email.
Check the account on PDRM's CCID Semak Mule portal, which lists bank accounts and phone numbers reported in scams. A clean result is not proof of safety.
Turn on multi-factor authentication for every mailbox, so a stolen password is not enough.
Publish SPF, DKIM and DMARC so criminals cannot easily send as your exact domain. Check your domain now, then follow the setup guide.
Require two people to approve new payees or large transfers.

If you have been scammed

What to do, in this orderSpeed matters most in the first 24 hours.

Right now
Call 997 (NSRC)The official portal says the line runs 24 hours daily and asks victims to call within 24 hours of discovering the scam, so banks can try to freeze the money (malaysia.gov.my).
Next
Call your bankTell them about the payment.
Then
Make a police reportAt the nearest police station, as the portal advises.
If hacked
Report to MyCERT (Cyber999)If a mailbox or computer was hacked. MyCERT operates from CyberSecurity Malaysia (mycert.org.my). Change passwords and turn on MFA.
If data leaked
Check the PDPA rulesIf customer or staff personal data was exposed, read our PDPA checklist on breach notification.

FAQ

What is the scam hotline in Malaysia?

997, the National Scam Response Centre. The government portal says it runs 24 hours daily.

Can DMARC stop all invoice scams?

No. DMARC stops criminals sending as your exact domain. It does not stop look-alike domains or emails from a hacked mailbox. Phone verification of bank changes is still essential.

Should we pay if the supplier's email looks genuine?

Not until you have confirmed the bank details by phone on a number you already have.