How to Spot Loan Scams: 10 Warning Signs and What to Do

Loan scams cost Malaysians hundreds of millions of ringgit every year. According to the Bank Negara Malaysia (BNM) Financial Consumer Alert List, unlicensed lenders and fraudulent loan syndicates are among the most frequently reported financial crimes in the country. The tactics these scammers use are growing more convincing — and more dangerous — every year.

This guide explains the most important warning signs of a personal loan scam, the sophisticated methods scammers are using right now, and the exact steps to take if you have already been targeted. Every resource mentioned here is official and verifiable.

Why Loan Scams Are on the Rise

Borrowers who struggle to qualify for traditional bank financing are the primary targets. If your CCRIS or CTOS record is unfavourable, you may be more likely to engage with an offer that promises guaranteed approval or unusually lenient terms — and scammers know this. They design their pitches specifically to appeal to people who feel they have few legitimate options.

Scam syndicates also impersonate real, licensed companies, including banks and registered moneylenders. The fact that a website, WhatsApp account, or social media profile carries a familiar brand name is no guarantee that it is legitimate. Always verify independently before sharing any personal information or making any payment.

10 Warning Signs of a Personal Loan Scam

No single indicator is conclusive on its own, but the more of the following apply to a lender you are considering, the higher the risk that you are dealing with a scammer.

1. You are asked to pay an upfront fee

This is the single most reliable indicator of a loan scam. No legitimate licensed lender in Malaysia will ask you to pay anything before your loan is disbursed. Any fees that legitimately apply — such as stamp duty or insurance premiums — are deducted directly from your approved loan amount, not collected in advance from you.

Scammers use many labels to make these payments sound official. Watch out for requests framed as any of the following:

• Processing fee or administrative fee
• Stamp duty deposit
• Loan insurance premium
• CCRIS or CTOS clearance fee
• SST or tax payment
• Account activation fee or "test transfer"
• Guarantor search fee
• Bank Negara Malaysia referral payment
• LHD or government authority processing fee
• Fee to "link" your account to the lender's system

If anyone asks you to pay for any of the above before receiving a loan, stop the conversation immediately.

2. Approval is guaranteed regardless of your credit history

Legitimate lenders assess your creditworthiness before making any commitment. They review your income, employment history, existing financial obligations, CCRIS record, and CTOS score. A lender who promises 100% approval or "no credit check required" is either unlicensed or running a scam. The promise is designed to attract people who have been rejected elsewhere.

3. The interest rate or terms look too good to be true

Genuine personal loan rates are tied to market benchmarks and the borrower's risk profile. Offers of 0% interest, extremely low flat rates, or unusually large loan amounts made without any financial assessment should be treated with immediate suspicion.

4. You are pressured to decide immediately

Scammers create urgency to prevent you from thinking clearly or verifying their credentials. Phrases like "this offer expires in 24 hours" or "you must pay the deposit today or lose your slot" are manipulation tactics. A legitimate lender will never penalise you for taking time to check their licensing status or compare options.

5. The lender contacted you first without any application

Unsolicited loan offers via SMS, WhatsApp, phone call, or social media are a major red flag. Legitimate banks and licensed moneylenders do advertise, but any actual offer should only follow after you have submitted a formal application. If someone is contacting you with a personalised loan offer you never requested, be extremely cautious.

6. You are asked to hand over your ATM or debit card

No licensed lender will ever require physical possession of your bank card as part of a loan application. Any request for your card — regardless of the justification given — indicates a scam.

7. The lender has no verifiable contact information or physical address

A legitimate financial institution will have a registered business address, a company telephone number, and a website with verifiable ownership. If all communication happens through a personal WhatsApp number, a generic Gmail account, or a messaging app with no company branding, treat it as a scam.

8. The lender is not listed on BNM's or KPKT's official registers

All licensed banks and financial institutions are regulated by Bank Negara Malaysia. All licensed moneylenders — now officially called Credit Communities — are registered under the Ministry of Housing and Local Government (KPKT) under the Moneylenders Act 1951. If a lender cannot be found on either official register, they are operating illegally.

9. The website or app seems suspicious or unofficial

Check that any website requesting your personal or financial information uses HTTPS (not HTTP) and displays a padlock icon in the browser address bar. Be especially cautious of .APK files sent via messaging apps — these are not official app store downloads and frequently contain malware.

10. You receive a last-minute change in terms or an unexpected fee request

If a lender suddenly introduces new fees after you have already agreed to terms, or asks you to make a wire transfer, pay via e-wallet, or send money to a personal account, stop the process immediately. This is a common final step in loan scam operations, designed to capture payment before the victim realises what is happening.

4 Advanced Tactics Scammers Are Using Right Now

Malicious App (.APK) Installation

Scammers posing as bank agents or credit officers on WhatsApp send a direct download file — typically a .APK — and claim it is a secure loan application portal or credit score checker. In reality, the app contains malware that intercepts your TAC/OTP messages, logs your keystrokes, and transmits your banking credentials to the scammer. Never install any file sent through a messaging app. Legitimate lenders only use apps available on the official Google Play Store or Apple App Store.

AI-Generated Deepfakes and Voice Cloning

Advances in artificial intelligence now allow scammers to produce convincing video calls or voice messages that appear to show real bank officials or corporate figures. These are used to demand deposit payments or extract sensitive credentials. No bank or licensed financial institution will ever ask for your password, full banking details, or an advance payment during a video call. If you receive such a call, hang up and contact the institution directly using the number on its official website.

Unsolicited Deposit Scam (Digital Loan Shark)

A scammer deposits a small, unexpected amount into your bank account. They then contact you claiming you have accepted a loan and demand immediate repayment with inflated interest, using harassment and threats. If you find an unexplained credit in your account, do not spend the money. Contact your bank branch directly, report the transaction as suspicious, and request a reversal through official banking channels. File a police report immediately.

Money Mule Recruitment

Individuals are offered easy commissions in exchange for receiving funds into their personal account and forwarding them to another account. By doing this, they are unknowingly laundering proceeds from scam victims. Under Malaysian law, anyone who allows their bank account to be used for this purpose can face criminal charges and a permanent blacklist from all banking services, regardless of whether they knew about the underlying scam.

How to Verify a Licensed Lender Before You Apply

Two minutes of verification before engaging with any lender can prevent serious financial and legal harm.

Step 1 — Check BNM's Financial Consumer Alert List

Bank Negara Malaysia maintains a publicly accessible list of unauthorised companies and websites involved in unlicensed financial activities. Before engaging with any lender, search for their name on the BNM Financial Consumer Alert List. If the company appears on this list, do not proceed under any circumstances.

Step 2 — Verify the lender on i-KrediKom

The Ministry of Housing and Local Government (KPKT) operates the i-KrediKom app, which allows you to check the licensing status of any registered moneylender in West Malaysia. Download it free from the Google Play Store or Apple App Store. Search the company's name and registration number. If no records are found ("Tiada Padanan"), the lender is not licensed.

Step 3 — Check the CCID Portal for known scam accounts

The Royal Malaysia Police Commercial Crime Investigation Department (CCID) maintains a database of bank account numbers and phone numbers linked to reported scams. Before transferring any money or sharing personal data, check the account or number at the CCID Semak Mule Portal. The steps are:

1. Visit https://semakmule.rmp.gov.my/
2. Select "Bank Account" or "Phone Number"
3. Enter the details of the party you are checking
4. Complete the CAPTCHA and click "Check Information"

If the number or account appears in the database, it has been reported in connection with a previous scam. Do not proceed.

What to Do If You Have Been Scammed

Act quickly. The faster you respond, the greater the chance of limiting your losses and preventing further harm.

1. Stop all contact with the scammer immediately. Do not reply to messages, do not make additional payments, and do not follow any further instructions they give you.
2. Document everything. Save screenshots of all conversations, payment receipts, any documents or agreements you received, and phone numbers or account details the scammer provided. Email copies to yourself with a timestamp.
3. Contact your bank immediately. Call the official fraud hotline on the back of your bank card. Ask them to freeze your account, reverse any recent transactions if possible, and flag any outgoing payments that have not yet cleared. Also ask about a provisional credit while the fraud is investigated.
4. Secure your personal information. If you shared your MyKad number, banking username, password, or TAC codes, assume your identity is at risk. Change all banking passwords from a clean device, enable two-factor authentication, and contact the Credit Bureau Malaysia or AKPK if you believe your credit file may be compromised.
5. File a police report. Include all evidence. You can file in person at any police station, or via WhatsApp or SMS at 013-2111222 (available daily 8am–12am). A police report is also important if the scammer is threatening you.
6. Report to the relevant authorities. Lodge a complaint with Bank Negara Malaysia via their BNMTELELINK service (1-300-88-5465), with the KPKT if the scammer posed as a licensed moneylender, and with the PDRM CCID directly.
7. Seek financial counselling if needed. AKPK (Agensi Kaunseling dan Pengurusan Kredit) provides free debt counselling and financial guidance. If the scam has caused significant financial hardship, their advisors can help you understand your options.
8. Monitor your credit reports. Check your CCRIS report through any licensed bank or through BNM's Credit Bureau, and your CTOS report at ctoscredit.com.my. Look for any credit applications or accounts you did not open.

Official Resources to Check and Report Scams

All of the following resources are free and operated by Malaysian government authorities.

If you are unsure whether a lender is legitimate, the safest approach is always to verify before you provide any personal information — not after. A few minutes spent checking the BNM alert list and i-KrediKom can prevent weeks or months of financial and legal complications.