What to Do After a Phishing Scam

Why a phishing link is more than a bad click

A phishing scam uses a fake link, message, or website that looks like your bank, an agency, or a familiar service. It asks you to log in, confirm your details, or enter a one-time password (OTP), and captures whatever you type.

Once your login details or an OTP are captured, a scammer can use them within minutes to log in or approve a transfer. This is why the moment you realise what happened, speed becomes the most important factor.

Even if you have not seen a transfer yet, treat captured details as a live risk, not a near miss.

Secure your accounts in the first hour

Change the password you entered on the fake site immediately, from a different device if possible, and change it anywhere else you reused it. Then call your bank to flag the account, even before checking for a transfer.

Turn on transaction alerts if they are not already active, and review recent logins or devices linked to your online banking and email. Remove anything you do not recognise.

If the phishing message also came through email, check whether your email account itself shows signs of unfamiliar access, since a compromised inbox can expose other accounts too.

Report to your bank and the police

Tell your bank exactly what happened, including the fake site or message. Ask them to review the account for unauthorised activity and consider a recall if a transfer already went through. File a police report, either at a station or with the Commercial Crime Investigation Department (CCID).

If a transfer happened recently, call the National Scam Response Centre (NSRC) on 997, since urgent cases can sometimes be flagged across banks faster this way. Keep the fake link, screenshots, and any messages as evidence.

What determines whether the money can be recovered

Recovery is more realistic when you act within hours and the funds went to a traceable Malaysian bank account. It becomes harder once the money has moved through several accounts or been converted to cryptocurrency.

Once a receiving account is identified and the amount is meaningful, a civil claim to trace and freeze the funds may be worth exploring. Legal help after a scam can help you weigh whether this fits your case, alongside whether legal action is worth pursuing.

What to do next

Secure your accounts first, then report to your bank and the police without delay. Each step you take quickly keeps more options open later.

For a wider view of what recovery can involve, see the recovery options overview. You do not need every answer before reaching out.