RM2.8 billion is how much Malaysians lost to scams last year, according to BNM’s fresh-off-the-press 2025 Annual Report. The report doesn’t shy away from the human toll either, recounting the plights of retirees being wiped clean and families watching emergency funds vanish overnight.

The Malaysian scam cases keep on piling up, like a recent one where a 55-year-old assistant manager from Bentong lost RM1.3 million in a phone scam. The modus operandi involved a single call from someone claiming to be from a delivery company and a quick chat with a fake “police officer”.

Within days, she’d transferred her entire EPF savings and investment funds into accounts controlled by a syndicate.

Now, nothing hits harder than waking up and seeing a lifetime of your earnings gone, all because you panicked, which is exactly what the scam call made her do.

PDRM has logged over 67,000+ in online crime cases, just like hers, in 11 months in 2025 alone. In spite of this, we all know that tomorrow is just another working day for the scam syndicates.

How does scam accountability look in practice, and more importantly, are enough measures being put in place to protect Malaysians and their money?

How Malaysia is Moving to Protect its Citizens

In 2024, BNM introduced a compensation framework through the Policy Document on Ensuring Fair Treatment for Victims of Unauthorised e-Banking Transactions (SEFT). SEFT promotes a shared approach to accountability between banks and their customers.

Progress using the framework has been encouraging. In 2025, the proportion of victims receiving full or partial compensation rose by about 26% compared to 2024.

Banks have also taken proactive steps to strengthen malware defences, with some reporting zero malware cases in 2025.

Some improvements the report noted to SEFT implementation include greater accountability in investigations, as banks check for their system’s weaknesses before placing accountability on customers. In several cases, banks have fully absorbed losses after identifying system weaknesses on their end.

There is also greater transparency around customer rights, with banks informing victims of their rights at the start of the investigation process. Banks are also showing more consistency in completing investigations within the 14-day timeline, which reflects improved case management without skimping on thoroughness.

Where cases take longer, banks are providing temporary financial assistance to help victims with their daily needs. Compensation decisions are also driving faster system fixes, as banks move more quickly to address identified weaknesses.

Other Measures That Are Working to Solve Scams, Too

Some of the operational moves in the report are notable. For example, to raise the bar for safer card payments and reduce fraud risks, one initiative is shifting away from SMS-based one-time passwords (OTP) and toward stronger authentication methods.

SMS OTP is still available as a fallback option to mitigate potential exclusion risk, such as using basic or older devices to transact via online card payments. But cardholders can now also opt for their own security settings, like disabling an online payment function or activating a “kill switch” for instant blocking when they detect suspicious activity.

BNM is also regularly reviewing measures implemented under the National Fraud Portal with PayNet and industry players. According to PayNet’s Senior Director, Risk & Compliance Division, Ken Yon, one out of five scam victims was able to get their money back.

@fintechnewsnetwork

Malaysians are recovering 100% of their money from scammers PayNet’s Ken Yon says that countries all around the world are reaching out to Malaysia to learn it is tackling fraud. #fintech #security #AI #financialcrime #scammers #fraud #fyp #foryou #Malaysia

♬ original sound – Fintech News Network – Fintech News Network

The National Fraud Portal can trace stolen funds in 30 minutes and has improved the detection of mule accounts by 14%.

Next, the National Scam Response Centre has switched to 24-hour operations through its hotline (997).  As of July 2025, the centre is managed by the Royal Malaysia Police’s Commercial Crime Investigation Department, giving the NSRC direct powers to investigate and act quickly.

Other Countries Are Moving Faster in Scam Oversight

BNM included a comparative table in its report, which showcased how countries like Thailand and Singapore are introducing compensation frameworks for victims alongside tighter security controls.

Developing this framework, BNM acknowledges, is not an easy affair. It requires a balance between fairness, legal limits, and implementation ease.

Despite starting in October 2024, Malaysia has the fewest number of parties involved, and covers unauthorised transactions compared to Thailand, whose effective date started in April 2025 and scope includes authorised and unauthorised payment fraud. Singapore, meanwhile, covers phishing-linked unauthorised transactions within its scope.

Next, Thailand, by far, has the most number of parties involved, including telcos, social media platform providers and digital asset operators too.

What’s telling about Malaysia’s scope, particularly, is that 95% of online fraud cases in Malaysia are authorised transactions. BNM acknowledges this and says that it will “explore stronger protection for vulnerable consumers” and assess whether SEFT’s scope should expand.

However, the report also cautions against undermining the importance of “customer vigilance”. The report notes that the most effective shield against scams, which helps build a more vigilant society, is knowledge; hence, efforts have been taken to accelerate consumer education.

While the human hazard concern is valid, it’s also worth considering PDRM’s breakdown keeps coming to mind: the single biggest loss category to non-existent investment schemes was RM1.37 billion, followed by telecom scams at RM715.7 million.

These are still people being professionally deceived by syndicates running industrial-scale operations.

The Global Anti-Scam Alliance reported that 62% of Malaysian scam victims experienced severe mental distress. At some point, “customer vigilance” stops being a policy framework and starts becoming a way to avoid the harder conversation about who else should be footing the bill.

So, Is It Enough?

Malaysia’s doing a lot of legwork, with SEFT, the NSRC’s round-the-clock hotline operations, and stronger authentication measures, as well as industry collaboration showing efforts in the right places. But when RM2.8 billion is walking out the door and 95% of fraud cases fall outside the current framework scope for SEFT, there needs to be a strong bridge to sort it out.

The accountability question Malaysia is facing is whether the entire system is built to match the severity of the challenge.

Featured image edited by Fintech News Malaysia based on an image by the National Anti-Financial Crime Centre on NFCC