A text says your parcel is stuck at customs. A caller claims to be from your bank, the police or a government agency, and says your account is linked to a crime. A friend of a friend shares an investment "guaranteed" to double your money. Scams come in many shapes, but most follow the same few patterns. Once you know them, they're much easier to spot.
This guide covers the warning signs that show up in almost every scam, the most common types, how to protect yourself, and exactly what to do if you think you've been scammed.
- Most scams share four signs: pretending to be someone you trust, a problem or prize, pressure to act now, and an unusual way to pay.
- Never share one-time passwords (OTPs), PINs or banking passwords with anyone, even someone who says they're from your bank.
- Contact organisations using details you find yourself, not the link or number in the message.
- "Guaranteed" high returns are a classic sign of an investment scam.
- If you've been scammed, contact your bank immediately. Speed matters.
The four warning signs
The US Federal Trade Commission (FTC) describes four signs that something is a scam. Almost every scam uses at least two of them:
- They pretend to be from an organisation you know, such as a bank, delivery company, government agency or well-known brand. Caller ID and sender names can be faked.
- They say there's a problem or a prize. Your account is frozen, you owe tax, a family member is in trouble, or you've won something.
- They pressure you to act immediately. They may tell you to stay on the line, keep it secret, or threaten arrest or account closure.
- They tell you to pay in a specific way: a transfer to a "safe account", gift cards, cryptocurrency, or a payment app.
Real banks, police and government agencies won't ask you to move money to a "safe account", read out a one-time password, or keep the call secret from your family.
Common scams to know
| Scam | How it usually works | Red flag |
|---|---|---|
| Impersonation calls | A caller claims to be from a bank, court, police or courier, and says you're under investigation or owe money | They ask you to transfer money or share banking details |
| Phishing texts and emails | A message with a link to "verify your account", "track your parcel" or "claim a refund" | The link leads to a site asking for your login, card or OTP |
| Investment scams | High, "guaranteed" returns, often promoted on social media, sometimes with fake celebrity endorsements | Pressure to invest quickly, and early "profits" to get you to invest more |
| Job scams | Easy online "tasks" for commission, such as liking videos or rating products | You're asked to pay or deposit money to unlock earnings |
| Online shopping scams | A cheap item from an unknown seller or a fake shop | Payment by direct transfer only, outside the platform |
| Romance scams | An online relationship that builds over weeks, then a request for money | They never meet in person or on video, and always have an emergency |
| Malicious apps | You're asked to install an app (often a file sent by message) to "complete" a booking or payment | An app from outside the official app store that asks for broad permissions |
Bank Negara Malaysia's scam education pages describe several of these, including Macau scams (impersonation calls), phishing, mobile application scams and mule accounts.
My own experience with an investment scam
I'm writing this section from personal experience, because I was caught by an investment scam myself.
The scheme presented itself as Barramundi. When I first put money in, the returns were good. I was paid a lot, and on time. That's what made me trust it. So I put in more money, and I even invited my family members and friends to join.
Once a lot of us had put in larger amounts, everything changed. The payouts stopped, and we never received the profits we were promised.
Looking back, it followed a pattern that many investment scams use:
- Real payouts at the start. The early "profits" weren't proof the investment was real. They were bait to build trust and get bigger deposits.
- Returns that were too good. Genuine investments rarely pay high, steady returns with no ups and downs.
- Growth through people you know. When a scheme grows because members recruit family and friends, that's a serious warning sign. It's also how the losses spread to the people you care about most.
If I could tell my past self one thing, it would be this: getting paid at the start doesn't mean it's safe. Before putting money into any investment, check that the company is licensed by your financial regulator. In Malaysia, check with the Securities Commission or Bank Negara Malaysia. And never bring in family or friends until you're sure.
How to protect yourself
- Stop and check. Australia's Scamwatch, quoted by Moneysmart, sums it up: stop, check, protect. Don't give money or information to anyone if you're unsure.
- Don't click links in unexpected messages. Type the website address yourself, or use the official app.
- Call back on a number you trust, from the back of your card or the official website, not the number that called you.
- Never share OTPs, PINs or passwords. No genuine organisation needs them.
- Only install apps from official app stores.
- Use strong, different passwords and turn on two-factor authentication for banking and email.
- Check investments before you invest. Confirm the company is licensed with your country's financial regulator, and check any warning or alert lists they publish.
- Talk to someone you trust. Scammers rely on secrecy and pressure. A second opinion breaks both.
In Malaysia, you can check whether a phone number or bank account has been linked to scams using the police's Semak Mule website before you transfer money to someone you don't know.
If you think you've been scammed
Act quickly. The sooner you report it, the better the chance of stopping further losses.
- Contact your bank immediately using its official hotline. Ask it to block your cards and accounts if needed and try to stop the transfer.
- In Malaysia, call the National Scam Response Centre (NSRC) on 997 if you've transferred money to a scammer.
- Change your passwords, starting with email and banking, and sign out of other devices.
- Remove any app the scammer asked you to install, and consider having your phone checked.
- Report it to the police and the relevant agency in your country (for example the FTC in the US, or Scamwatch in Australia), and to the platform where you met the scammer.
- Watch out for "recovery" scams. People who promise to get your money back for a fee are often scammers too.
Being scammed is not a sign of stupidity. Scams are run by organised groups who are very good at what they do. Reporting helps protect others.
Help older family members
Older relatives are often targeted with impersonation calls. A simple family rule helps: "Before you transfer money to anyone because of a phone call or message, call one of us first." Share this article, and save your bank's official hotline in their phone.
Frequently asked questions
Can my bank get my money back?
Sometimes, especially if you report it quickly, but it isn't guaranteed. That's why contacting your bank straight away matters.
How do I know if an investment is legitimate?
Check that the company is licensed by your country's financial regulator, be wary of guaranteed returns, and never invest because of pressure or a social media advert. This article doesn't recommend any investment.
What if someone asks to use my bank account?
Say no. Letting others use your account to move money can make you part of a crime, even if you didn't know it was illegal money. These are called mule accounts.
The bottom line
Scams rely on trust, panic and speed. Slow down, check who you're really dealing with using contact details you find yourself, never share your OTP or PIN, and talk to someone before you move money. If something goes wrong, call your bank immediately. A safe financial life is built on protecting what you've saved, as much as on building it.
How we wrote this: this guide draws on the US Federal Trade Commission, Moneysmart (Australian Government), Bank Negara Malaysia and the Royal Malaysia Police's Semak Mule service, listed below. Check your own country's official scam reporting service.
