This article first appeared in Digital Edge, The Edge Malaysia Weekly on September 14, 2026 - September 20, 2026
Malaysia has built a growing arsenal of measures to combat online scams, from public awareness campaigns and content takedowns to mechanisms that trace and freeze stolen funds. Yet, the persistence of online scams suggests the country’s response may need to look beyond protecting users at or before the point of attack, and avoid placing the onus entirely on victims.
According to the Aug 28 discussion paper titled “Hook, line and sinker: Cyber financial scams in Malaysia”, by Khazanah Research Institute’s (KRI) senior research associate Jun-E Tan, consultant research associate Bor Neng Quan and former research intern Kuhaneetha Bai Kalaicelvan, a series of regulatory and non-regulatory initiatives have been implemented at different stages of the cyber financial scam life cycle. However, there is a significant gap as prevention remains too heavily centred on the individual.
Consumers are repeatedly told to verify information, recognise suspicious messages and avoid clicking on fraudulent links. But as scammers become increasingly sophisticated in their use of technology to identify, target and deceive victims, this approach may no longer be sufficient.
The scam anatomy illustrated in the paper explains the limitations of such an approach. A scam does not begin when a victim receives a message or transfers money.
Before that happens, scammers may obtain personal data, establish fake identities, create fraudulent content and set up channels through which victims can be reached.
For example, scammers can use artificial intelligence-powered image generation tools to create realistic profile pictures or direct victims to spoofed websites designed to resemble legitimate ones.
The scale of the problem underscores the gap. Malaysia recorded 67,735 online scam cases as at November 2025, more than double the number for the whole of 2024.
In 2025, the Ministry of Home Affairs reported RM2.77 billion in losses from online scams, translating to roughly RM7.6 million lost every day.
Social media and other application service providers are particularly exposed in the scam life cycle. Social media platforms have high penetration in the country, with 85% of the population connected to them, making them a natural channel for scammers to reach potential victims.
The Global Anti-Scam Alliance, in its “State of scams in Malaysia 2025” report published last year, also identified YouTube (26%), X (7%) and Reddit (5%) among the social media platforms popular with scammers.
Beyond individual awareness, other issues include how effectively service providers detect fraudulent activity and whether their algorithms inadvertently amplify scam-related content.
The solution lies in earlier intervention across the scam chain, the KRI researchers say, with greater responsibility placed on social media platforms, telecommunications companies, financial institutions and other service providers that can either enable or disrupt scammers’ operations.
There are already signs of such a structural approach emerging, including measures to block scam-related websites, deploy content moderation tools and crack down on money-laundering schemes involving cryptocurrency platforms.
KRI observes, however, that Malaysia’s regulatory activities are more heavily focused on financial and investigative measures towards the tail end of the scam anatomy. Less emphasis is placed on earlier stages, where technology can be used to lay the groundwork for deception and target potential victims, the researchers point out.
KRI says policy interventions therefore need to consider the entire scam life cycle and distribute risk and responsibility among the various actors involved.
As technology advances, it is increasingly unrealistic to expect individuals to keep pace with evolving risks while shouldering responsibility for protecting themselves and their communities.
Malaysia’s anti-scam framework could require those controlling digital, telecommunications and financial infrastructure to play a bigger role in stopping scams before they reach users.
KRI says the concept of distributing risk and responsibility among key enabling actors, including telecommunications companies and financial institutions, can be drawn from countries such as Taiwan and Singapore.
The Monetary Authority of Singapore and the Infocomm Media Development Authority jointly developed the Shared Responsibility Framework, which sets out guidelines for allocating responsibility for losses arising from scams.
Under the framework, financial institutions are held accountable first as the “custodians of consumers’ money” if they fail to discharge their duties. Telecommunications companies are next in line for responsibilities related to SMS delivery for digital payments.
If both fulfil their duties, the victim bears the financial loss. However, if either or both institutions fail in their duties, they may be required to bear the loss and compensate the consumer.
KRI also recommends that Malaysia establish a public dashboard on scam statistics as a central repository for data such as the number of reports received, total financial losses and demographic breakdowns of scam types.
The institute also highlights the shortage of cybersecurity professionals and calls for greater investment in developing and retaining talent while ensuring public and private entities allocate sufficient resources to train non-cybersecurity personnel.
Save by subscribing to us for your print and/or digital copy.
P/S: The Edge is also available on Apple's App Store and Android's Google Play.