Malaysia's AI Scam-Checking App

A welcome step but what can decide its success?

When Prime Minister Datuk Seri Anwar Ibrahim tabled the 5th MADANI Budget 2027 on 9 October, one line probably stood out for anyone who has worked on battling scams: the National Scam Response Centre (NSRC) will develop an AI-powered app that lets the public check suspicious phone numbers, bank accounts and links before they transfer money.

I spent years on the platform side of this fight, including representing Meta on the National Scams Taskforce. From that seat, I saw how much effort goes into the problem and how many parties need to align to tackle it. So I read this announcement as a constructive step. Whether it succeeds will depend on a few design choices made now: the data behind it, the trust people place in it, and what surrounds the app.

What was announced

The app will let anyone check a phone number, bank account or web link before making a payment. The NSRC, which brings together the Royal Malaysia Police (PDRM), Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC), the National Anti-Financial Crime Centre (NFCC), banks and telcos, will build it.

It builds on existing anti-scam work, and on a problem that remains large:

The app also sits within a wider digital agenda in the Budget 2027 speech, which gives useful context to:

• Data sovereignty. A planned Sovereign AI Cloud to keep "the rakyat's data and the nation's strategic information" under Malaysian control.

• Safe and ethical AI. Almost RM15 million for AI Malaysia Berhad to support a safe and ethical AI ecosystem.

• Home-grown data protection. The National Cyber Security Agency (NACSA) and MCMC to develop local data protection technologies.

• Online safety at scale. MCMC to expand its Safe Internet Campaign to all schools.

The shift

For years, much of the public conversation on scams has centred on what social media platforms and telcos should do. Those players do carry real responsibility. But scams are an ecosystem problem, and no single sector can solve it alone. This announcement signals that the government is putting a direct, citizen-facing tool in people's hands.

• It moves from reaction to prevention. Today, most action happens after money is gone. A check before transfer is the moment that matters most.

• It uses the state's unique position. Bringing police reports, bank data and telco data under one roof.

• It builds public confidence. A trusted, official place to "check first" gives ordinary Malaysians, especially seniors, a simple habit to adopt.

• It complements, rather than replaces, industry action. Platform and telco obligations still matter. This adds a layer the public can use themselves.

The data question: what will the AI learn from?

"AI-powered" is only as strong as the data behind it, and this is where I think the design work will matter most. AI cannot reliably flag every new scam if the underlying police reports, account records and threat intelligence are incomplete or outdated. Gaps in the data become blind spots in the app.

PDRM's Semak Mule already lets the public check numbers and accounts. Its limitation, as the Malaysia Cyber Consumer Association (MCCA) has noted, is that a number usually appears only after a police report is filed. Scam links can change within hours, and new numbers and mule accounts keep appearing. A tool that waits for reports will always be a step behind.

For the AI to predict risk rather than repeat history, it will likely need:

1. Real-time signals from banks. Unusual inflows into new accounts, rapid pass-through of funds, and mule patterns.

2. Telco signals. New SIMs making high volumes of calls, spoofed numbers, and bulk SMS behaviour.

3. Platform signals. Fake ads, impersonation pages and links reported on social and messaging apps.

4. Feedback from users. Every check and every "this was a scam" report becomes training data, if it flows back quickly.

5. Clear data-sharing rules. Legal clarity on what can be shared, how fast, and with what privacy protections.

Some of these data flows should already exist through the NSRC. Others may need new agreements and investment. The open question is not whether Malaysia has data. It is whether that data can be joined up, cleaned and refreshed fast enough to stay ahead of syndicates.

Trust and false positives

A scam checker lives or dies on public trust. Three safeguards deserve attention early:

• A clean result is not proof of safety. "No record found" must never read as "safe." The app should communicate uncertainty clearly, for example with risk levels and plain-language advice to stay cautious.

• False positives need a fair remedy. Innocent businesses or individuals wrongly flagged need a fast, fair way to appeal. NACSA has already raised this risk of secondary victimisation.

• Users' data must be protected. People will be entering phone numbers, account details and links. That information needs strong privacy and security safeguards, in line with NACSA's guidance on securing AI systems.

Is an App alone enough?

An app is a powerful tool, but it only helps if people remember to use it in the moment that counts. Scams work by creating urgency, fear or excitement. That is exactly when people are least likely to pause and check. To make the app effective, it helps to think about the system around it:

• Build the "check first" habit. Sustained public campaigns, in Bahasa Malaysia, English, Mandarin and Tamil, that make checking as natural as looking both ways.

• Meet people where they already are. Integrate the check into banking apps, DuitNow and FPX payment screens, and WhatsApp, so people do not need to open a separate app.

• Design for seniors. Large text, simple steps and voice options. Older Malaysians are heavily targeted and often less confident with apps.

• Equip the helpers. Children, grandchildren, community leaders and bank staff can coach others to check before they pay.

• Act fast on the back end. As MCCA has noted, high-risk alerts need investigators ready to freeze funds within minutes.

• Close the loop. Tell users what happened after they reported. Singapore's ScamShield app, which notifies users when their report is verified, is a good model.

A strong start, and a shared opportunity

This scam-checking app is a meaningful signal. It shows the government is willing to build tools that put protection within reach of every Malaysian. That deserves support. Making this work does not fall on the government alone.Banks, telcos, platforms, NGOs, employers and families all have a part to play. If we get the design right, Malaysia has a real chance to turn the tide on scams.

————————————————————————————————————————————————————————-

Sources

• Speech: The Fifth MADANI Budget 2027 (Prime Minister's Office)

• Budget 2027: AI-powered scam-checking app a welcome move, experts say (The Star)

• Budget 2027: NSRC to develop AI app to help public check for scams (Fintech News Malaysia)

• Budget 2027 promises an AI scam-check app. Malaysians lost RM5.37b since 2024 (ProductNation)

• Anti-scam efforts (Singapore Ministry of Digital Development and Information)

An Opinion on ‘Trust in the Age of AI’

Trust is not built by AI being perfect. It's built by humans being accountable.

We live in an age where anyone can generate a perfect-looking report in three minutes. A client proposal that looks professionally designed. A legal analysis that sounds authoritative. An email that sounds like you.

In this world, speed benefits, but where does 'Trust' sit?

Trust can no longer be built the old way—through brand reputation, fast delivery, or clever campaigns alone. Those signals are easy to fake now. The competitive edge has shifted entirely. Trust in this age is built on verifiability. On transparency. On the ability to stand behind a decision and say: "A human reviewed this. A human approved this. I am accountable for this."

Organizations that understand this are winning. Those that don't are accumulating trust debt—with customers, employees, regulators, and partners. And they don't even know it yet.

Here’s an opinion on three dynamics reshaping trust in the age of AI:

1. Trust Has Moved from Productivity to Verifiability

When every company can produce slick marketing materials in minutes, what separates trustworthy from trustless? The ability to show your work. To document decisions. To explain the reasoning—not just the outcome. 

A financial advisor who can show why they recommended an investment (with audit trail, disclosure, human review) wins over one who just produces a recommendation. A consulting firm that documents how AI assisted their analysis (with human sign-off) wins over one that hides it. A company that says "This draft was written by an AI and reviewed by a strategist" builds trust, not loses it.

2. The Efficiency Paradox: Move Fast, But Move Together

Microsoft's 2026 Work Trend Index indicates that Malaysian employees are moving faster with AI than their organizations are prepared for. That's the trap. When people move fast alone, trust drops inside the team. Colleagues don't understand the tools being used, and managers may not see what's happening. Governance lags behind actual practice. Shadow AI becomes the default. 

The organizations winning aren't slowing down—they're synchronizing. "Move fast, but move together" is how you rebuild trust. The mechanism? Culture becomes your compliance system. When teams share clear norms about what tools they use, what they never put into an AI tool, and how they check each other's work—you don't need surveillance. You have shared accountability.

That's the paradox: better governance makes teams faster, not slower.

3. Accountability Cannot Be Outsourced

An AI cannot be fired. An AI cannot apologize. Only a person and a company can. Trust in the age of AI is a leadership decision, not a technology feature or a simple checkbox.

"Human-in-the-loop" is not a technical safeguard. It's a moral statement that says: "A human stands behind this, and when something goes wrong, there's someone you can hold accountable."

If you can't name the person responsible for an AI decision, you don't have governance—you have deniability. And customers, partners, and regulators can sense the difference immediately.

The question you need to think about

This is not a technology problem. You don't need a new tool to solve this. You need a decision. Specifically, someone in your organization needs to answer one question: "Who is accountable if an AI tool makes a mistake that harms a customer?"

If you can't answer that clearly—if the answer is "the technology," or "we'll figure it out if it happens," or "nobody really"—you don't have trust architecture yet. 

The moment you can name a person and a process, the moment accountability becomes real, everything else becomes possible. Communication becomes easier. Governance becomes cultural. Teams move faster instead of slower. And trust happens.

Move Fast, But Move Together: Leadership in the Age of AI

AI is boosting productivity, but lasting advantage comes from leadership. How leaders can move fast and move together by pairing AI efficiency with people culture.

In the past couple of weeks I've had conversations with University professors and senior business leaders about the relationship between AI and leadership. AI somewhat has this seductive story: deploy it and the automation and productivity gains will materialize. But what often gets left behind is a culture that goes hand-in-hand.

The shift I'm seeing in how leaders think about this is telling.

Leadership teams used to ask: "How do we get our team to use AI?"

Now it's: "How do we lead well while our team uses AI?"

That's not a semantic difference. That's a fundamental reorientation. The companies winning with AI aren't winning because they have better algorithms or bigger budgets. They're winning because their people have permission to imagine what's possible, safety to experiment, and clarity about why change matters. That's culture work. And it's work that starts in the boardroom. 

The Leadership Stakes Have Changed

Stanford GSB makes a powerful point when it stated that AI raises the stakes for leadership. While it can accelerate decision-making, it can also create a false sense of certainty. A leader armed with AI outputs but no cultural clarity is, dare I say, a leader making faster mistakes at scale.

If your organization is already deploying AI without intentional culture work, you're not too late.

• Start with diagnosis, not deployment. Audit your current culture: Where do teams already experiment? Where do they resist change if it exists? Where do decision-making bottlenecks reside? The answers will point out where AI adoption would stall.

• Then, integrate cultural readiness into your AI roadmap. Run change management in parallel with technology rollout, not after. Redesign decision rights and incentives before teams have to navigate AI workflows. Build psychological safety explicitly, not by hoping it emerges.

• And tell the truth to your people. Not "AI will make everything better," but "AI will change how we work, and here's what that means for you, your role, and your growth."

Culture change is harder to communicate than capability demos. But it's also the difference between an AI implementation that works and one that sits in a folder gathering dust.

So, leaders, take the time to clarify:

• Which tasks should be automated

• Where human judgment is required

• Who holds responsibility for outcomes

Leaders who move fast and move together aren't the ones who deployed AI first. They're the ones who asked: How do we lead well through this change? And then did the harder work of answering that question.

If your organisation is moving fast with AI but you are sensing the team is not moving together, let us help you reset the balance.