Speed is the entire game. Once money leaves your account, the only thing standing between you and a total loss is how fast somebody freezes the receiving account — and that window is measured in hours, not days.
Malaysia's answer to this is the National Scam Response Centre and its 997 hotline. It is not a complaints line and it is not a police substitute. It is a fast-action desk that exists to interrupt a transfer in progress.
What the NSRC Actually Is
The NSRC is a joint operation, not a single agency. It brings together the National Anti-Financial Crime Centre (NFCC), the Royal Malaysian Police, Bank Negara Malaysia and the MCMC, alongside financial institutions and the telecommunications industry.
That structure is the point. A single call can reach the bank holding the receiving account and the police at the same time, which is what makes a freeze possible.
The Two Numbers, and Which to Call First
Your bank's own fraud hotline. Most major Malaysian banks run this 24 hours. Call it first if the scam happened outside NSRC operating hours.
NSRC 997. The hotline is reachable from 8am to 8pm daily, including public holidays.
If the transfer happened at 2am, do not wait until 8am to act. Call your bank immediately, then call 997 when it opens. The bank can initiate a hold on its side without the NSRC.
The 24-Hour Rule
This is the single most important detail in this guide. Calls to the NSRC should be made within 24 hours of the incident.
After that window, the practical chance of recovery drops sharply, because the money has usually been layered through several accounts or withdrawn. The NSRC will still take the report, and you should still make one, but the freeze mechanism is far less likely to catch anything.
Do not spend that 24 hours gathering evidence, screenshotting conversations or trying to confront the scammer. Call first. Document after.
What to Have Ready Before You Dial
Having this in front of you turns a fifteen-minute call into a five-minute one.
- A short chronology of what happened. When contact started, what you were told, when you transferred.
- Your own details. Full name, contact number, IC number, and the bank account the money left from.
- Transaction details. The receiving account number, the bank it belongs to, the exact amount, and the time of transfer.
The receiving account number is the critical field. Without it there is nothing to freeze. If you transferred through an e-wallet or a payment link and do not have an account number, say so — the reference number is the next best thing.
Step by Step
1. Stop transferring. If the scammer is still messaging you asking for a "release fee", a "tax" or a "verification deposit", that is the second stage of the same scam. Nothing you send recovers the first amount.
2. Call your bank's 24-hour fraud line. Ask them to flag the transfer and, if it is still within their system, to attempt a recall.
3. Call 997. Give the chronology and the transaction details. You will be issued a reference.
4. Lodge a police report. This is not optional and it is not replaced by the NSRC call. File at the nearest police station as soon as possible after reporting to the bank or the NSRC. The report is what the bank and any subsequent investigation rely on. Our walkthrough on how to lodge a police report in Malaysia covers the process and what to bring.
5. Secure everything else. Change the passwords on the account you transferred from, and on any account sharing that password. Revoke any remote-access app the scammer asked you to install.
6. Keep every reference number. The NSRC reference, the bank's case number and the police report number are three separate things and you will be asked for all of them.
What the NSRC Can and Cannot Do
It can coordinate a freeze on a receiving account while funds are still there. It can pull the bank and the police into the same conversation in one call. It can log the account and number for pattern detection.
It cannot guarantee that you get your money back. It cannot prosecute anyone. It cannot act on a transfer where the funds have already been withdrawn.
Be wary of anyone — including services advertising online — who promises recovery for a fee. Recovery scams specifically target people who have just been scammed, because that list is easy to build.
Before You Transfer: The Two-Minute Check
Most of this is avoidable with a check that takes less time than the transfer itself.
Semak Mule. The police-run database lets you check whether a bank account number or phone number has been reported in a scam. We have a full guide on using Semak Mule to check an account or phone number.
Company verification. If you are paying a business you have never dealt with, confirm it exists. Our guide to checking whether a Malaysian company is real covers the SSM search.
Bank Negara's own list. BNM publishes fraud and scam notices naming entities and schemes that have been flagged.
If Your Bank Handles It Badly
The NSRC route and a complaint against your bank are separate tracks.
If you believe your bank failed to act on a timely report, mishandled the freeze, or is refusing to engage with a legitimate dispute, that is a financial services complaint. Raise it with the bank's own complaints unit in writing first, then escalate. Our guide on escalating a bank or insurance complaint to FMOS sets out the thresholds and the process.
FAQ
What is the NSRC 997 hotline?
997 is the hotline for Malaysia's National Scam Response Centre, a joint operation of the NFCC, PDRM, Bank Negara Malaysia, the MCMC, banks and telcos. It exists to act fast on scam transfers, primarily by attempting to freeze the receiving account.
What are the 997 operating hours?
8am to 8pm daily, including public holidays. Outside those hours, call your bank's own 24-hour fraud hotline first.
How long do I have to report a scam to the NSRC?
Calls should be made within 24 hours of the incident. After that, funds have usually moved or been withdrawn and the freeze mechanism is far less likely to help.
Do I still need to make a police report?
Yes. The police report is separate from the NSRC call and from your bank's case, and you should file it at the nearest station as soon as possible after reporting.
Will I get my money back?
There is no guarantee. A freeze only works while the funds are still sitting in the receiving account. Reporting fast gives you the best chance, but recovery is not assured — and anyone promising guaranteed recovery for a fee should be treated as a second scam.
Can I check an account number before I pay?
Yes. Semak Mule, run by PDRM, lets you check a bank account number or phone number against reported scam cases before you transfer.
