Built for the thirty seconds before the tap.
Every scam starts the same way: an ordinary person, a convincing message, and a moment of doubt. The scammer only needs that moment to go one way. We build for the other one. What follows is the research that made us. Read it the way we did, one finding at a time.
The escalation.
Between 2020 and 2026, scams in Malaysia grew up. What started as clumsy phone calls and fake online shops became an organised, technology-driven industry. Reported cases climbed from around 17,000 in 2020 to 25,479 in 2022, then 34,532, then 35,368. In 2025 the curve snapped. Powered by AI tools and ready-made attack kits, cases jumped 87% in a single year to 66,204 reported cases
, and direct losses nearly doubled to RM2.97 billion. The first five months of 2026 added another RM830 million.
Up 87% in one year. AI-assisted kits made 2025 the tipping point.
The dark figure.
The police numbers only count the people who came forward. Most victims never do. Some are ashamed. Some fear that reporting a task scam makes them look like a mule account suspect. Most simply stop believing the money will come back. Count the unreported cases and the State of Scam Report puts Malaysia's true annual loss at RM54.02 billion, about 3% of GDP. The doubters are usually right. The national response centre has frozen RM32.49 million since 2022 and returned RM10.9 million of it, and only 2% of victims ever fully recover what they lost.
…the 2 in green got everything back. The other 98 didn't.
Where the money goes.
The money follows a pattern. Fake investment schemes are the biggest earner, surging from RM848 million in 2024 to RM1.46 billion in 2025
, ahead of phone scams at RM802 million and romance scams. The map tells the same story. Selangor and Kuala Lumpur carry 59% of nationwide losses between them, and Sabah and Sarawak each crossed RM110 million as syndicates pushed into East Malaysia. Hover the map to see what 2025 cost each state.
Same old playbook will always work on elders.
The playbook is old, and it still works. A Facebook ad offers cheap cleaning or festive catering. The chat moves to WhatsApp. The booking app arrives as an APK file. Once installed, it reads SMS, takes over accessibility controls, shows a fake bank login and quietly captures everything typed into it. When the bank sends a TAC code, the malware grabs it and hides the alert. One Sarawak case lost RM44,074 in eight transfers inside an hour. In Kuching, a 71-year-old answered an online job offer and wired RM527,130 across 23 transfers
into sixteen mule accounts.
The targets are chosen on purpose. In these cases, most victims are past retirement age.
When the threat learned to talk.
Since 2023, the threat has a voice and a face. Deepfake investment ads have worn the likeness of the King, the Prime Minister and Bank Negara governors
. In targeted studies, 85% of victims believed the fake videos were real before they lost money. Voice cloning needs just three seconds of audio from a public profile to stage a distress call from a family member. MCMC has taken down nearly 225,000 scam and deepfake posts since 2022, and the pipeline keeps refilling.
Who gets targeted.
Every generation gets its own scam. Retirees face Macau calls and deepfaked authority figures. Seniors lost over RM552 million between 2021 and 2023, often their entire EPF savings, and one 90-year-old in Petaling Jaya lost RM3.83 million alone. Working adults and homemakers meet the poisoned APK. The young are not spared, they are recruited. For RM200 to RM1,000, students hand over bank accounts and become money mules, with 39,006 active mule cases
on record by mid-2025 and up to ten years in prison waiting.
What must change.
So we built the answer we wished existed. CyberCopilot is one scanner for the thirty seconds before the tap. A link, an email, a chat, an SMS, a QR code or an app file, six ways to scan in one place. Every scan runs six security checks at once, and AI-powered reasoning weighs the evidence the way an analyst would, then explains the verdict in plain words. That is how checking becomes easier than falling. And every scan feeds a community database, so one person's close call becomes everyone's early warning.
The next suspicious message is already on its way.
Check it before you trust it. Get CyberCopilot on the device where the scams actually land.