You've Just Been Scammed. The Next Hour Decides Whether You Get It Back.

There is a specific silence that happens about ninety seconds after you realise.

You are still holding the phone. The transfer went through, the person on the other end has stopped answering, and your brain is doing something unhelpful: replaying the last twenty minutes, looking for the exact moment you should have known. Underneath that is a feeling you will recognise even if you have never been scammed, which is that you cannot possibly tell anyone about this.

That feeling is going to cost you more than the transfer did.

We have written before about the four lines every money scam uses, which is the guide for the ten minutes before. This is the guide for the hour after, and it is the one almost nobody writes, because it assumes you failed. Scam attempts hit Malaysian phones constantly, and sooner or later most people either get targeted directly or watch it happen to someone close to them. Knowing this in advance is the difference between acting and freezing.

The breakdown

Your money is not gone when you send it

This part is worth understanding properly, because without it the urgency reads as generic advice and you will not move fast enough.

When you transfer money to a scammer, it does not go to a person. It lands in a mule account, which is a real bank account belonging to a real Malaysian, opened either by someone recruited with a fake job or someone who sold their details. That account is a staging point.

From there, the money moves. It gets broken up, pushed through more accounts, converted, or withdrawn in cash. Each hop makes it harder to follow and each withdrawal makes it unrecoverable, because you cannot freeze cash.

So there are two different moments, and everyone confuses them:

Moment	What it is	Can you still act?
You press send	The money leaves your account	Yes. It is now sitting somewhere identifiable.
It is withdrawn or layered onward	The money leaves the mule account	Mostly no. There is nothing left to hold.

The gap between those two moments is your entire window. It can be hours. It can be minutes. It is the only variable you control, and you spend it deciding whether to tell anyone.

This is also why “the bank will sort it out” is the wrong mental model. What a freeze does is put a hold on a balance still physically sitting in the receiving account. It has nothing to do with goodwill. If the balance is gone, there is nothing to hold, and no amount of paperwork afterwards conjures it back.

The first hour, in order

Do these in sequence. Do not research, do not check whether it was really a scam, do not wait until morning.

1. Call the National Scam Response Centre on 997. The NSRC is a joint operation between the police, Bank Negara, the telecoms regulator and the banks themselves. The point of the single number is that one call routes to all of them at once, instead of you working the phone yourself while the money moves. Check its operating hours before you rely on it as your only route, because it has not always run around the clock.

2. Call your bank’s own 24 hour hotline. This is the number on the back of your debit card, not the branch, not the in-app chat, not email. If it is 3am and 997 is closed, this is your first call instead. Ask them explicitly to attempt a recall on the transaction and to flag the receiving account. Get a reference number for the call before you hang up.

3. Lodge a police report. Same day if you can. There is no published deadline for the report itself, but Bank Negara’s own guidance says the call to NSRC has to happen within 24 hours of the incident, so treat that as the clock you are working against. The report is not a formality and it is not about catching anyone. It is the document everything afterwards attaches to, so make it, and keep the report number somewhere you can find it in a hurry. You will be asked for it.

4. Lock down anything they touched. Many banking and e-wallet apps now carry a kill switch or account-freeze function, and the e-wallet compensation rule turns on whether those safeguards were in place. If you gave up a password, an OTP, a MyKad number or card details, assume all of it is compromised. Change the passwords, kill the card, and check whether anything else uses the same login. If you installed an app or clicked a link that asked for permissions, the phone itself may be the problem, not just the account.

Have this ready before you call

You will be asked for these, and hunting for them mid-call burns the window. Screenshot everything now, before you delete the conversation out of embarrassment, which people genuinely do.

The recipient’s account number and bank name, exactly as it appeared
The amount, date and time of every transfer, and the transaction reference for each
The phone numbers, WhatsApp or Telegram handles they contacted you from
Screenshots of the whole conversation, including the parts that make you cringe
Any website URL or app they sent you to
Your own ID and account details for verification

The cringe-worthy parts matter most, incidentally. Investigators are pattern-matching against other reports, and the script is the pattern.

What the NSRC can and cannot do

Worth being precise about, because expectation mismatch is where people give up.

It can coordinate between the police, the banks, the central bank and the telecoms regulator quickly, get the receiving account flagged and frozen if there is still money in it, and put your case into a system where the same mule account turning up across many separate reports becomes visible.

It cannot compensate you. It is a response and coordination centre, not an insurer and not a court. Getting your money back depends on whether funds were still sitting in the account when the freeze landed, and then on a separate process to release them to you.

Be realistic about the odds. Published figures on how much scam money is actually returned to victims in Malaysia, set against how much is lost each year, are bleak. That is not a reason to skip the calls, because moving fast is the one thing that improves them, and not reporting at all closes the door completely. It is a reason to not plan your finances around a recovery.

The second scam

This one is worth knowing about now, while you are calm.

A few days or weeks after a scam report, some victims are contacted by someone offering to recover the lost funds. They may claim to be from a recovery agency, a law firm, a cyber unit, sometimes an overseas regulator. They know details about your case, which is the part that makes it convincing. They ask for an upfront fee, a processing payment, or a “release” charge before the money can be returned.

It is often the same operation running a second pass, and it works because it arrives at the exact moment you are most willing to believe someone can fix this. Nobody has publicly explained how the second callers get hold of case details, but they do, so a caller knowing yours proves nothing about who they are.

The rule is simple. No legitimate agency, police force, bank or regulator asks a scam victim to pay a fee to release funds that have already been frozen or recovered. If someone says they are holding your money and wants a payment before it can reach you, the recovery is the scam. Pursuing a scammer through the civil courts does carry filing fees, but that is you choosing to sue, initiated by you, through a court, with no guarantee at the end. It is not a stranger phoning to say your money is ready. Verify any caller by hanging up and calling the institution back on a number you looked up yourself, never a number they gave you.

The reframe

The hour does not get lost to deliberation. You do not spend it weighing options. You spend it sitting very still, running the sequence of events again, trying to work out how you, a person who knows better, ended up here. The overwhelming instinct is to fix this quietly, or to wait until you feel less stupid, or to check one more time whether maybe it is fine.

That instinct is not weakness. It is shame, and shame’s whole function is to make you go quiet and stop moving.

Which is why it is worth seeing shame as part of the scam rather than as your reaction to it. The design does not end at the transfer. Every element that made you vulnerable in the moment, the urgency, the authority, the secrecy, the pressure not to check with anyone, keeps working afterwards. The person who is too embarrassed to call 997 tonight is behaving exactly as intended. The silence is the last thing they need from you, and it is free.

The money is not gone when you send it. It is gone when it is withdrawn. Everything between those two moments belongs to whoever moves first, and shame is what makes sure it is not you.

You can be humiliated and on the phone at the same time. The humiliation will still be there tomorrow either way, and it will not have cost you anything extra. Being late will have.

Action step

Do this before you need it, because you will not be capable of research while your hands are shaking.

Put 997 in your phone now, saved as something you will find under pressure. Add your bank’s 24 hour hotline from the back of your card next to it. Two minutes.
Do the same on your parents’ phones. Do it for them rather than telling them to, because the step that never gets done is the one that requires someone else to go and find a number first.
Look up your bank’s fraud line and check the NSRC’s current hours so you know tonight, not at 2am, which number is actually answering.
Learn the check tool before you need it. PDRM runs a public lookup for checking whether an account number or phone number has appeared in scam reports. Use it before any transfer to someone you have not met.
Say the sentence out loud once: if this happens, I call within the hour and I tell someone. Rehearsing the decision now is the closest thing there is to a defence against freezing later.

And if you are reading this because it already happened, and it happened yesterday, or last week: call anyway. A late report still puts the mule account in the system, still connects to other reports, and still contributes to the account being shut before it takes someone else’s money. The window for your ringgit may have closed. The one for the next person has not.

Want the cheat sheet?

📥 If you want the earlier half of this, the part that stops the transfer happening at all, the free Adulting Money Starter Kit covers the scam patterns alongside your first 5 money moves. Get it here →