The Face in the Video Is Not the Evidence. It Is the Product.

You have seen the format even if you scrolled past it. A short video, a face you recognise, a number that sounds like a decision rather than a pitch. The Prime Minister. Elon Musk. Someone from Petronas senior management. The audio is slightly wrong in a way you notice and then forgive, because the alternative is believing that someone went to the trouble of faking it, and people do not go to that trouble for you.

They do, though. Police have named it as one of the tools now being used across a category of fraud that has cost Malaysians RM3.24 billion.

The breakdown

The scale is not a scare statistic, it is a rate

Bukit Aman’s Commercial Crime Investigation Department put numbers to this at a briefing on 7 September 2026. Between 2023 and July 2026, investment fraud in Malaysia accounted for 26,196 cases and RM3.24 billion in losses. Police reported 14,591 arrests and 6,571 charges over the same period.

Divide the loss by the days in that window and you get about RM2.48 million a day, every day, for three and a half years. That figure is the police’s own framing, and the arithmetic checks out against the case total.

The victim profile is the part worth sitting with, because it does not match the story most people tell themselves about who falls for this:

	Reported victims
Private sector workers	13,241
Male	15,021
Female	11,175

Private sector employees are the single largest recorded group. Police listed retirees, the unemployed, civil servants and businesspeople among the other victims, without giving counts for each, so the useful comparison is only this one: the biggest recorded block of victims is salaried people with a payslip and a banking app. Whatever mental image you have of who falls for this, it is worth checking it against that line.

The mechanism has four moving parts

Police described syndicates using AI-generated images and video of well known figures, wrapped in claims of syariah compliance, promising returns around 300%, and connected to networks of mule accounts. Read as a system rather than a list, it does something specific at each stage:

1. The face borrows trust you have already given someone else. You are not being asked to trust a stranger. You are being asked to trust a judgement you believe a public figure has already made.
2. The framing borrows trust from something you cannot easily interrogate. A “syariah-compliant” label attaches a moral assurance to a financial claim. The two are unrelated. A scheme can be structured to look compliant and still be a fraud, because compliance describes the form of a contract and says nothing about whether the money exists.
3. The return is the tell. 300% is not an aggressive forecast. It is a number chosen to be large enough to override the part of you that would otherwise check.
4. The top-up is where the loss actually happens. Police described victims persuaded to make an initial investment and then asked for more, described as taxes, processing fees or “profit activation.” The first payment is the hook. The rest is the harvest, and it is collected after you can see a balance on a screen that says you are already winning.

And the money lands in mule accounts, which is why speed matters so much once it has gone.

What actually changed this year

The part that got less coverage than the headline is the text of the rule itself, and it is the more useful half.

The Online Safety Act 2025 [Act 866] is in force, and on 22 May 2026 the Malaysian Communications and Multimedia Commission published the Risk Mitigation Code under section 80 of that Act. It came into enforcement on 1 June 2026.

Two provisions in it are aimed almost precisely at the video in your feed.

Labelling. Licensed service providers must

“Ensure that generated or manipulated images, audio or video that closely resemble real persons, objects, places, entities or events and are likely to falsely appear authentic or truthful to a person, are clearly distinguishable through prominent labels or markings when presented on the service’s online interface.”

Advertiser identity. Licensed service providers must

“Ensure that paid-for advertisements for the sales of goods and/or services are only permitted on the service if they are from advertisers or users (as the case may be) who are verified against Government-issued records.”

The Code defines those government-issued records to include, for organisations, a certificate of incorporation or registration, and for individuals, NRIC, passport or work permit.

The Code also confirms that “content on financial fraud” sits in the First Schedule of the Act as harmful content, alongside the categories you would expect. Scam content is not a grey area in Malaysian law. It is named.

Why none of that is your defence

Three gaps, and they are structural rather than teething problems.

The Code binds licensed service providers. That is its defined term: a licensed applications service provider or licensed content applications service provider. It is not a rule that binds every website your phone can reach. In a media statement on 3 January 2026, MCMC noted that X “is not presently a licensed service provider,” while maintaining it still has a duty to prevent harmful content. The obligation and the enforcement handle are not the same thing.

A label describes the content, not the offer. Suppose the system works perfectly and the video arrives stamped as AI-generated. That tells you the face is synthetic. It tells you nothing about whether the scheme behind it is real. Nothing in the Code requires the offer to be genuine, only the synthetic content to be marked, and a fraudulent scheme advertised with an accurate label has still complied. There is a second-order risk worth naming as a risk rather than a prediction: if most synthetic video in your feed ends up labelled, the absence of a label starts to feel like a guarantee of authenticity. It is not one, and it never was.

Verification proves existence, not permission. This is the one that costs people money, so it is worth being slow about.

Verifying an advertiser against a certificate of incorporation proves that a company legally exists and that someone completed a registration. It is not a licence to take deposits, manage funds, or offer capital market products, and Malaysian law hands those to two different regulators under two different Acts:

• Taking deposits is banking business under the Financial Services Act 2013, which says no person may carry it on unless “licensed by the Minister, on the recommendation of the Bank,” meaning Bank Negara Malaysia.
• Fund management, dealing in securities, investment advice and financial planning are regulated activities under the Capital Markets and Services Act 2007, and the Securities Commission is the sole licensing authority for them.

A scheme can be a genuinely incorporated Malaysian company, pass advertiser verification exactly as the Code intends, and still be committing an offence the moment it takes your money.

Existence and permission are two different registers, and only one of them protects you.

The reframe

The instinct everyone has here is to get better at spotting fakes. Look at the hands, listen to the audio, check whether the blink rate is off. That instinct feels like diligence and it is actually the trap, because it accepts the scammer’s framing: that the question in front of you is whether this video is real.

It is not. The question is whether this offer is licensed, and that question has a free, public, five-second answer that does not depend on your eyesight at all.

A licensed operator has a licence number, and a licence number is checkable by anyone in seconds. A famous face is what an offer leans on when the checkable thing is missing. The face is not the evidence. It is the product they are selling, and the investment is the invoice.

Which means the deepfake is not a new kind of threat requiring a new kind of vigilance. It is the oldest one, rendered better. You were never supposed to be evaluating the messenger.

Action step

Do the positive check, not the negative one. This distinction is the whole action step, so do not skim it.

The negative check is asking “is this on a blacklist?” Bank Negara publishes the Financial Consumer Alert List of entities not authorised by it, and Bank Negara states plainly what absence from that list means:

“The absence or subsequent removal of an entity or a scheme from the FCA List however should not be construed as confirmation that such entity or scheme is or has been licensed or regulated by BNM.”

A name that is not on the list has not been cleared. It has not been looked at. Failing to find something is not a finding.

The positive check is asking “is this licensed?” and it is the one that actually returns an answer:

1. Run the name through the Securities Commission’s Investment Checker at sc.com.my. It verifies whether an individual or entity is authorised by the SC to offer, promote or sell capital market products and services in Malaysia, and it will also flag a name that sits on the SC’s Investor Alert List. Search the entity and, separately, the person in the video pitch.
2. Check the company name against both registers, not one. SSM registration answers “does this company exist.” The SC register answers “is it allowed to do this.” You need the second answer. The first one is nearly free to obtain and nearly worthless as assurance.
3. If the name returns nothing, that is your answer. An unlicensed operator is not a promising early-stage opportunity you found before the regulators did. Unlicensed means you have no protection under Malaysian securities law if it goes wrong, which the SC says in as many words.
4. Treat any request for a further payment to release your own money as the end of the conversation. Taxes, processing fees, profit activation: these are not steps in an investment. They are the business model.

One name, one search box, thirty seconds, before any money moves. The video was never going to be the thing that told you.

Want the cheat sheet?

📥 The free Adulting Money Starter Kit includes a ten-second scam red-flag checklist alongside your first 5 money moves. Get it here →