Malaysia needs to shift its approach to cyber financial scams away from placing disproportionate responsibility on individual victims towards making financial institutions, telecommunications companies and digital service providers more accountable for preventing fraud, according to the Khazanah Research Institute (KRI).
In its 2026 paper, Hook, Line and Sinker: Cyber Financial Scams in Malaysia, researchers Jun-E Tan, Bor Neng Quan and K. Kuhaneetha Bai said online scams resulted in RM2.77 billion in losses in 2025, based on Home Ministry figures.
That translates into losses of about RM7.6 million a day, highlighting the growing financial cost as Malaysians spend more time online and increasingly rely on digital financial services.
KRI warned that the problem shows little sign of easing as scammers become more sophisticated, using technology to expand the scale of their operations and refine their methods of deception.
The researchers define a cyber financial scam as financial loss resulting from a victim voluntarily taking an action after being deceived by perpetrators operating in an online environment.
Drawing on desk research and stakeholder discussions, KRI developed what it calls a “Scam Anatomy” framework to examine the problem from the perpetrators’ perspective.
The framework identifies seven stages in a typical scam lifecycle, beginning with groundwork and operational preparation before moving to establishing contact and interacting with potential victims. The process ultimately ends with the scammers disappearing and cashing out the funds extracted from victims.
Using the framework to assess Malaysia’s regulatory and non-regulatory responses, the researchers found that numerous rules and initiatives already cover different parts of the scam lifecycle.
However, gaps remain particularly in the governance of emerging technologies, even as the government moves to address these shortcomings.
KRI also found that many existing initiatives are reactive and concentrated towards the financial extraction stage of a scam rather than stopping perpetrators earlier in the process.
There has also been a disproportionate emphasis on financial and digital literacy campaigns and individual responsibility, the researchers said.
KRI called for risks and responsibilities to be distributed more broadly among the key institutions that enable digital transactions and communications.
Under this approach, financial institutions, telecommunications companies and application service providers would be expected to effectively discharge their respective obligations in preventing and responding to scams rather than leaving consumers to bear the full burden when fraud occurs.
The institute also called for greater use of technology to connect Malaysia’s existing legal and information systems so authorities can respond at a speed and scale closer to that of scammers.
One proposal is the development of a scam advertisement detection tool that could work alongside provisions under the Online Safety Act to facilitate effective removal of fraudulent content.
KRI also proposed a dedicated scam-prevention application integrating existing official databases and tools, providing consumers with a single authoritative platform to verify suspicious activity and obtain guidance on how to respond.
Another recommendation is the establishment of a public-facing scam monitoring dashboard providing accurate and timely data.
KRI said such a platform could reduce discrepancies between data maintained by different agencies, establish a transparent baseline for measuring scam activity, increase public vigilance and potentially improve incident reporting.
The researchers also argued that anti-scam education needs to move beyond basic advice on identifying fraudulent activity.
More engaging and evidence-based approaches, including scam simulations and awareness sandboxes, should be considered to help people develop practical resilience against increasingly sophisticated forms of manipulation.
Laws Need To Keep Pace With Technology
KRI called for remaining legal gaps to be closed, particularly those involving emerging technologies, while future legislation should be designed to prevent new forms of fraud rather than responding only after they become widespread.
Law enforcement agencies also need greater resources and capacity to keep pace with increasingly sophisticated criminal operations, while safeguards should accompany stronger enforcement to minimise unintended consequences.
The report additionally identified cybersecurity capabilities as an important component of Malaysia’s longer-term response, calling for greater investment in developing and retaining cybersecurity talent.
Taken together, KRI’s recommendations suggest Malaysia’s fight against scams needs to evolve from a predominantly victim-focused and reactive model towards a system-wide prevention strategy, in which banks, telecommunications companies, technology platforms, regulators and enforcement agencies share responsibility for disrupting scams at multiple points before money reaches criminals.
