Malaysia's AI Scam-Checking App

Written by Justin Murugaya

A welcome step but what can decide its success?

When Prime Minister Datuk Seri Anwar Ibrahim tabled the 5th MADANI Budget 2027 on 9 October, one line probably stood out for anyone who has worked on battling scams: the National Scam Response Centre (NSRC) will develop an AI-powered app that lets the public check suspicious phone numbers, bank accounts and links before they transfer money.
I spent years on the platform side of this fight, including representing Meta on the National Scams Taskforce. From that seat, I saw how much effort goes into the problem and how many parties need to align to tackle it. So I read this announcement as a constructive step. Whether it succeeds will depend on a few design choices made now: the data behind it, the trust people place in it, and what surrounds the app.

What was announced

The app will let anyone check a phone number, bank account or web link before making a payment. The NSRC, which brings together the Royal Malaysia Police (PDRM), Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC), the National Anti-Financial Crime Centre (NFCC), banks and telcos, will build it.
It builds on existing anti-scam work, and on a problem that remains large:
The app also sits within a wider digital agenda in the Budget 2027 speech, which gives useful context to:
  • Data sovereignty. A planned Sovereign AI Cloud to keep "the rakyat's data and the nation's strategic information" under Malaysian control.
  • Safe and ethical AI. Almost RM15 million for AI Malaysia Berhad to support a safe and ethical AI ecosystem.
  • Home-grown data protection. The National Cyber Security Agency (NACSA) and MCMC to develop local data protection technologies.
  • Online safety at scale. MCMC to expand its Safe Internet Campaign to all schools.

The shift

For years, much of the public conversation on scams has centred on what social media platforms and telcos should do. Those players do carry real responsibility. But scams are an ecosystem problem, and no single sector can solve it alone. This announcement signals that the government is putting a direct, citizen-facing tool in people's hands.
  • It moves from reaction to prevention. Today, most action happens after money is gone. A check before transfer is the moment that matters most.
  • It uses the state's unique position. Bringing police reports, bank data and telco data under one roof.
  • It builds public confidence. A trusted, official place to "check first" gives ordinary Malaysians, especially seniors, a simple habit to adopt.
  • It complements, rather than replaces, industry action. Platform and telco obligations still matter. This adds a layer the public can use themselves.

The data question: what will the AI learn from?

"AI-powered" is only as strong as the data behind it, and this is where I think the design work will matter most. AI cannot reliably flag every new scam if the underlying police reports, account records and threat intelligence are incomplete or outdated. Gaps in the data become blind spots in the app.
PDRM's Semak Mule already lets the public check numbers and accounts. Its limitation, as the Malaysia Cyber Consumer Association (MCCA) has noted, is that a number usually appears only after a police report is filed. Scam links can change within hours, and new numbers and mule accounts keep appearing. A tool that waits for reports will always be a step behind.
For the AI to predict risk rather than repeat history, it will likely need:
  1. Real-time signals from banks. Unusual inflows into new accounts, rapid pass-through of funds, and mule patterns.
  2. Telco signals. New SIMs making high volumes of calls, spoofed numbers, and bulk SMS behaviour.
  3. Platform signals. Fake ads, impersonation pages and links reported on social and messaging apps.
  4. Feedback from users. Every check and every "this was a scam" report becomes training data, if it flows back quickly.
  5. Clear data-sharing rules. Legal clarity on what can be shared, how fast, and with what privacy protections.
Some of these data flows should already exist through the NSRC. Others may need new agreements and investment. The open question is not whether Malaysia has data. It is whether that data can be joined up, cleaned and refreshed fast enough to stay ahead of syndicates.

Trust and false positives

A scam checker lives or dies on public trust. Three safeguards deserve attention early:
  • A clean result is not proof of safety. "No record found" must never read as "safe." The app should communicate uncertainty clearly, for example with risk levels and plain-language advice to stay cautious.
  • False positives need a fair remedy. Innocent businesses or individuals wrongly flagged need a fast, fair way to appeal. NACSA has already raised this risk of secondary victimisation.
  • Users' data must be protected. People will be entering phone numbers, account details and links. That information needs strong privacy and security safeguards, in line with NACSA's guidance on securing AI systems.

Is an App alone enough?

An app is a powerful tool, but it only helps if people remember to use it in the moment that counts. Scams work by creating urgency, fear or excitement. That is exactly when people are least likely to pause and check. To make the app effective, it helps to think about the system around it:
  • Build the "check first" habit. Sustained public campaigns, in Bahasa Malaysia, English, Mandarin and Tamil, that make checking as natural as looking both ways.
  • Meet people where they already are. Integrate the check into banking apps, DuitNow and FPX payment screens, and WhatsApp, so people do not need to open a separate app.
  • Design for seniors. Large text, simple steps and voice options. Older Malaysians are heavily targeted and often less confident with apps.
  • Equip the helpers. Children, grandchildren, community leaders and bank staff can coach others to check before they pay.
  • Act fast on the back end. As MCCA has noted, high-risk alerts need investigators ready to freeze funds within minutes.
  • Close the loop. Tell users what happened after they reported. Singapore's ScamShield app, which notifies users when their report is verified, is a good model.

A strong start, and a shared opportunity

This scam-checking app is a meaningful signal. It shows the government is willing to build tools that put protection within reach of every Malaysian. That deserves support. Making this work does not fall on the government alone.Banks, telcos, platforms, NGOs, employers and families all have a part to play. If we get the design right, Malaysia has a real chance to turn the tide on scams.

————————————————————————————————————————————————————————-

Sources
Justin Murugaya
Next

An Opinion on ‘Trust in the Age of AI’