Scams and online fraud: a guide for victims

Key points

Deceiving someone into handing over money or property is cheating; when property is handed over the punishment is 1 to 10 years’ jail with whipping and a fine (Penal Code ss 415, 420).
Getting into someone’s account or device without permission is an offence under the Computer Crimes Act 1997 (s 3); doing it to commit fraud carries up to 10 years (s 4).
Any police officer must take your report of an offence committed anywhere in Malaysia (Criminal Procedure Code s 107(4)).
You can ask for a status report on the investigation; the police must give it within two weeks of your request, subject to exceptions (CPC s 107A).
A civil claim normally has a 6-year time limit, but for fraud the clock starts only when you discovered it, or could with reasonable diligence have discovered it (Limitation Act 1953 ss 6, 29).

Is it a crime? Cheating and personation

A person cheats when, by deceiving someone, he fraudulently or dishonestly induces that person to deliver property or to consent that anyone keeps property, or intentionally induces him to do or not do something he would not otherwise have done, causing or likely to cause harm to body, mind, reputation or property (Penal Code s 415).
Dishonestly hiding facts is a deception for this purpose; but a mere breach of contract is not, by itself, proof of fraudulent intent at the start (s 415, Explanations).
Dishonestly means intending to cause wrongful gain to one person or wrongful loss to another; fraudulently means with intent to defraud (ss 24, 25).
Cheating by personation — pretending to be someone else, real or imaginary, such as a fake banker, police officer or relative — is a separate offence (s 416).

Punishments

Offence	Maximum punishment
Cheating (s 417)	Up to 5 years’ jail, or fine, or both
Cheating by personation (s 419)	Up to 7 years’ jail, or fine, or both
Cheating and dishonestly inducing delivery of property (s 420)	Jail of not less than 1 and not more than 10 years, with whipping, and liable to a fine
Unauthorised access to a computer (CCA s 3)	Fine up to RM50,000, or up to 5 years’ jail, or both
Unauthorised access to commit or help commit fraud or dishonesty (CCA s 4)	Fine up to RM150,000, or up to 10 years’ jail, or both
Unauthorised modification of computer contents (CCA s 5)	Fine up to RM100,000, or up to 7 years, or both; up to RM150,000 or 10 years, or both, if intended to cause injury

Hacked accounts and devices

It is an offence to make a computer perform any function intending to get access to a program or data, knowing the access is unauthorised (Computer Crimes Act 1997 s 3(1)). The intent need not be aimed at any particular program, data or computer (s 3(2)).
It is a more serious offence to do this intending to commit, or help someone else commit, an offence involving fraud or dishonesty — whether then or later (s 4).
Changing the contents of a computer without authority, temporarily or permanently, is also an offence (s 5).

Making a police report

If you report an offence orally at a police station, the officer in charge must write it down, read it back to you, enter it in a book with the date and hour, and you sign it (Criminal Procedure Code s 107(1)–(2)).
A report made to a police officer outside a station is treated as received at a station, and must later be written down and signed (s 107(3)).
A police officer is duty bound to receive information about an offence committed anywhere in Malaysia — you can report at any station (s 107(4)).
Keep everything: screenshots, chat logs, bank transfer receipts, account numbers and phone numbers used by the scammer. A certified copy of the information recorded under s 107 can be admitted as evidence (s 108A).

Following up: the status report

After reporting, you may ask the officer in charge of that station for a report on the status of the investigation (s 107A(1)); it must be given within two weeks of your request (s 107A(2)).
The officer need not give it unless the offence is a seizable offence and four weeks have passed since your report, nor where it would contain matter likely to harm the investigation or prosecution (s 107A(3)).
If you do not receive it in time, you may report the failure to the Public Prosecutor, who must then direct the Officer in charge of the Police District to give him a detailed status report, and will have a status report given to you (s 107A(4)–(6)).

Getting your money back through the courts

A criminal case punishes the offender; to recover money you may also bring a civil claim. Claims founded on contract or tort must be brought within six years of the date the cause of action accrued (Limitation Act 1953 s 6(1)).
Where the claim is based on the defendant’s fraud, or the fraud concealed your right to sue, the six years do not start until you discovered the fraud or could with reasonable diligence have discovered it (s 29(1)).
That extension does not let you recover property that has since been bought for value by someone who was not part of the fraud and did not know of it (s 29(1), proviso).
For small sums see small claims; for enforcing a judgment see enforcing a judgment.

Laws cited on this page

Act 254	Limitation Act 1953 Akta Had Masa 1953 Our guide →	PDF · PDF (BM) · Official ↗
Act 563	Computer Crimes Act 1997 Akta Jenayah Komputer 1997 Our guide →	PDF · PDF (BM) · Official ↗
Act 574	Penal Code Kanun Keseksaan Our guide →	PDF · Official ↗
Act 593	Criminal Procedure Code Kanun Tatacara Jenayah Our guide →	PDF · PDF (BM) · Official ↗

Each law links to our mirror page: a copy of the official text captured on a known date, its version history, and the official source. Law library →

Worked examples

Example 1: The fake bank officer

Facts. Aina receives a call from a man claiming to be from her bank. He says her account is compromised and persuades her to transfer RM8,000 to a “safe account”.

The law. He deceived her and dishonestly induced her to deliver money (Penal Code s 415), while pretending to be someone else (s 416).

Outcome. He can be charged under s 420 (1–10 years, whipping and fine) or s 419. Aina should report at any police station (CPC s 107(4)), keep the transfer receipt and call records, and may ask for a status report later (s 107A).

Example 2: Discovering the fraud late

Facts. Ravi paid a deposit for a car that did not exist. He discovered three years later, through a news report, that the seller ran a scam.

The law. For a claim based on fraud the limitation period does not start until the fraud was discovered or could with reasonable diligence have been discovered (Limitation Act 1953 s 29(1)).

Outcome. Ravi’s civil claim is not out of time merely because more than six years may pass from the payment; the six years under s 6 run from when he discovered, or reasonably could have discovered, the fraud.

Examples are simplified illustrations with invented names; real cases turn on their own facts.

Questions & answers

Is it a crime if someone simply did not deliver what I paid for?

A mere breach of contract is not by itself proof of fraudulent intent (Penal Code s 415, Explanation). It is cheating if the person deceived you from the start to get you to pay (s 415); otherwise your remedy may be a civil claim.

What punishment does a scammer face?

Cheating that induces you to hand over property is punishable with 1 to 10 years’ jail and whipping, and a fine (Penal Code s 420). Pretending to be someone else carries up to 7 years (s 419).

Must I report at the police station near my home?

No. A police officer is duty bound to receive information about an offence committed anywhere in Malaysia (Criminal Procedure Code s 107(4)).

Can I check on the progress of my report?

Yes. Ask the officer in charge of the station where you reported; a status report must be given within two weeks of your request, though not before four weeks have passed since your report, only for seizable offences, and not where it would harm the investigation (CPC s 107A).

How long do I have to sue for money lost in a scam?

Six years for claims in contract or tort (Limitation Act 1953 s 6). If the claim is based on fraud, the period starts only when you discovered the fraud or could with reasonable diligence have discovered it (s 29).

Someone logged into my account without permission. Is that an offence even if they took nothing?

Yes. Unauthorised access is itself an offence, with a fine up to RM50,000 or up to 5 years’ jail or both (Computer Crimes Act 1997 s 3); if done to commit fraud the maximum rises to RM150,000 or 10 years (s 4).

All questions & answers → · Ask your own →

This page explains the general position in Malaysia (last reviewed October 2026). It is not legal advice — check the current law and get advice on your own facts.

Sources

Penal Code Computer Crimes Act 1997 Criminal Procedure Code Limitation Act 1953 Small claims (RM5,000 and below)Enforcing a judgment Getting legal help