A woman in Selangor picked up a call last year, heard her boss's voice, and did exactly what he asked — bought thousands of ringgit in Touch 'n Go PINs and read the codes back over the phone. Her real boss's phone had been off the whole time. The voice on the line was AI, and it was good enough that she didn't second-guess it until the money was gone.
That case isn't a one-off anymore. It's the shape of where scam calls in Malaysia are heading in 2026 — less "bad grammar, obvious script," more "sounds exactly like someone you'd trust."
When a Cloned Voice Calls You First
Voice cloning tools now need only a short audio clip — a voice note, a video, even a public interview — to generate a convincing fake of someone's speech. Scammers pair this with WhatsApp calls or spoofed numbers so the whole interaction feels ordinary right up until the ask.
Bukit Aman's Commercial Crime Investigation Department (CCID) had already logged 454 fraud cases involving deepfake technology by 2024, with combined losses of RM2.72 million, according to Malaysian media reports on police figures. The pattern in most of these cases is the same: an urgent request from someone who sounds exactly like a relative, a boss, or a colleague, asking for cash, prepaid PINs, or a quick bank transfer.
Deepfake video has followed the same playbook at a bigger scale. Fabricated clips of Prime Minister Anwar Ibrahim, tycoon Robert Kuok, and AirAsia's Tony Fernandes have all been used to "endorse" fake investment schemes on social media — convincing enough that even the Johor royal press office had to publicly deny a doctored video of the Sultan promoting an investment product.
Underneath the AI headlines, ordinary phishing hasn't gone away either. CyberSecurity Malaysia's Cyber999 Incident Response Centre logged 1,881 cyber security incidents in the fourth quarter of 2025 alone, with fraud — mostly phishing, impersonation, and fraudulent websites — the single largest category. Voice cloning is the flashy new layer sitting on top of a scam ecosystem that was already large.
The Numbers Behind the Panic
Investment scams are where the real money is disappearing. Malaysians lost RM2.11 billion across 13,956 investment fraud cases in 2024, and around 85 percent of victims said they were persuaded after watching an AI-generated endorsement video, per figures reported by Malay Mail.
The following year didn't slow down. Police recorded RM1.47 billion in investment scam losses across 9,603 cases in 2025, with working adults aged 31 to 50 — people with savings, stable income, and family commitments — the most targeted group, according to cybersecurity experts quoted by Sinar Daily.
What's shifted is the method, not just the tech. Malaysia's scam scene used to run mostly on fear: a caller claiming to be a cop or a court officer, warning you're under investigation, pushing you to transfer money before you can think it through — the so-called Macau scam. What's showing up more now is patience. Scammers build a relationship first, sometimes over days of casual chat, before the money request even comes up. AI just makes that relationship-building faster and more convincing to sustain.
Five Ways to Catch a Fake Before You Pay
A few habits catch most of these calls before they cost you anything. Cloned audio can still slip up on odd pauses, flat emotion, or a slightly off cadence when the call gets long — but don't rely on your ear alone, because the good ones won't have a tell.
Hang up and call back on a number you already have saved. Never the number that just called you — that's the whole trick. If it's really your brother, your boss, or your bank, they'll still be reachable on the contact you already trust.
Agree on a family code word. A short phrase only your household knows is still one of the most effective checks against a cloned voice, because scammers can copy a tone but not a shared secret.
Be suspicious of anyone asking for Touch 'n Go PINs, OTPs, or gift card codes. No legitimate bank, employer, or government agency asks for these over a call. This applies whether the caller claims to be from a bank, JPJ (Road Transport Department), or LHDN — if you're unsure whether a fine or notice is real, check it directly through the agency's own portal rather than a link or number given over the phone, the same way you'd verify a JPJ summons online instead of trusting a caller's word for it.
Treat "invest now, guaranteed returns" videos as a red flag by default, especially ones using a public figure's face. Real regulated investments don't need a deepfake of a tycoon to sell themselves.
Lean on the verification tools your bank already gives you. Features built into DuitNow in 2026 exist specifically to slow down and flag suspicious transfers — don't rush past a warning prompt just because someone on the phone is pressuring you to.
What to Do in the First Hour
Speed matters more than almost anything else here. Communications Minister Fahmi Fadzil cited a case where a victim lost RM1 million but only reported it eight hours later — by then, only RM170,000 could be frozen. In a separate case where the victim called immediately, authorities recovered nearly the full amount.
If you've already transferred money, call the National Scam Response Centre (NSRC) at 997. As of 2026, the hotline runs 24 hours and the call itself counts as an official police report, so there's no need to also queue up at a police station. The NSRC is a joint operation between PDRM, Bank Negara Malaysia (BNM), the Malaysian Communications and Multimedia Commission (MCMC), and the banking industry, built specifically to freeze funds before they move through layers of mule accounts.
Before transacting with an unfamiliar number or account at all, run it through Semak Mule, PDRM's free public portal for checking phone numbers, bank accounts, and company names flagged in past fraud reports. For scam attempts that don't involve a bank transfer — phishing links, fake apps, hacked accounts — CyberSecurity Malaysia's Cyber999 centre takes reports and can advise on next steps.
It's also worth checking your own credit standing occasionally, especially if you think your identity or an old account might have been roped into a mule network without your knowledge — you can pull your CCRIS and CTOS report for free to catch anything unusual early.
FAQ
What is a Macau scam?
It's a fear-based scam where the caller impersonates police, a bank officer, or a court official, claims you're under investigation or your account is compromised, and pressures you to transfer money immediately to "verify" or "protect" your funds. Authorities note the trend is shifting toward slower, relationship-based scams, but Macau-style calls still circulate.
How do I know if a voice on the phone is AI-cloned?
You often can't tell by ear alone — that's the point. The reliable check is behavioural: hang up and call the person back on a number you already have saved, or ask something only they'd know. Urgency and a request for money, PINs, or codes are the real tell, regardless of how the voice sounds.
What number do I call if I've been scammed in Malaysia?
Call the NSRC hotline at 997. As of 2026 it operates 24/7 and the call itself is treated as an official police report, so you don't need a separate report at a police station.
Can I check if a phone number or bank account is linked to past scams?
Yes. PDRM's Semak Mule portal lets you search phone numbers, bank account numbers, and company names against past fraud reports before you transact with someone you don't know.
Are deepfake videos of Malaysian public figures illegal to make and share?
Impersonating public figures, including royalty, in fabricated content used to defraud people can fall under existing fraud and communications laws, and authorities have publicly warned against circulating such videos. If you spot one promoting an investment scheme, report it rather than share it.
