A scratch-and-win scam Malaysia operation running out of luxury bungalows in Penang was dismantled on 22 September 2026, with 29 foreign nationals arrested and a haul of broadcasting equipment seized. Penang police chief Datuk Dennis Lim Kwang Keng confirmed the raids at a press conference on 1 October, describing a syndicate that had been operating for two to three months and had converted rented properties into call centres.
The target of the operation was not Malaysian consumers. Police said the syndicate used Facebook Live to reach victims in China and Cambodia, which is why the seizure list reads less like a fraud case and more like a small studio: mobile phones in the hundreds, laptops, desktop computers, modems and routers, and purpose-built broadcasting equipment.
What the scratch-and-win scam Malaysia raids uncovered
Three raids, three bungalows, one pattern. The first raid in Teluk Kumbar produced 14 arrests; a second raid on two nearby bungalows produced seven more; the third, at Solok Bukit Belah, produced eight. The rented premises cost the syndicate around RM10,000 a month each, and police said operators were paid up to RM8,000 a month to run the broadcasts.
| What police seized | Quantity |
|---|---|
| Mobile phones | 251 |
| Laptops | 17 |
| Desktop computers | 2 |
| Modem and router sets | 6 |
| Other items | Customer records, scratch-and-win cards, suspected fake licences and certificates, studio and communication equipment |
How the prize scam worked
The structure was a two-stage extraction, and recognising it is the practical value of the case.
Stage one creates the win. Victims were shown or told they had won a grand prize. Nothing was paid to enter, or the entry cost nothing meaningful – because the money is not in the entry, it is in the release.
Stage two creates the fee. To collect, victims were told to pay processing fees, taxes and insurance. Payment was taken by QR code. Police said the QR codes were believed to have been registered in Cambodia, and that they were tracing the flow of funds. The prize never arrived, and the money could not be withdrawn.
The design is worth naming because it survives translation. The prize can be replaced with an investment return, a parcel release fee, a job placement or a tax refund. The constant is a reason to pay a small amount to unlock a larger amount, delivered through a channel that feels immediate – and a live broadcast creates urgency in a way a static advertisement cannot, because the audience can see other people apparently being told the same thing.
The figures, and where the reports differ
Two details do not reconcile across the day’s reporting, and it is fairer to record that than to quietly pick one.
On the nationality breakdown, Bernama reports 19 Chinese nationals and 10 Cambodians among the 29 arrested, and The Star also reports 19 Chinese – but The Star specifies 18 men and one woman, while Bernama’s raid-by-raid totals read 14 Chinese men in the first raid, then three Chinese men plus one Cambodian man and three Cambodian women in the second, then two Chinese men and six Cambodian women in the third. The totals agree on 29; the per-raid composition differs in how the reports group them.
On the legal provisions, Bernama cites Section 6(1) and Section 15(1)(c) of the Immigration Act 1959/63, while The Star cites Sections 6(3) and 15(1)(c). Both reports agree the principal charge is Section 420 of the Penal Code, read together with Section 120B for criminal conspiracy.
What is consistent across every report: 29 suspects aged between 20 and 63, remanded until 13 October 2026, and an investigation that police say is still working towards identifying the syndicate’s mastermind.
What to do if you are approached
Do not pay, and do not continue the conversation to gather more information – the goal of the exchange is to move you to the payment step, and staying engaged only extends it. Screenshot everything before you block the account, because the record is what any report will need.
Report to the police and, for financial fraud, to the National Scam Response Centre, which coordinates between the police, Bank Negara Malaysia and the communications regulator to try to intercept funds while they are still traceable. Speed matters more than completeness at that point: a report filed while the transfer is still in flight has options that the same report filed a week later does not.
Malaysian consumers who have paid a fraudulent seller also have the consumer claims tribunal available for disputes over goods and services, at a RM5 filing fee and a RM50,000 ceiling. It is not the primary route for a cross-border criminal syndicate, but for a local seller who took money and delivered nothing, it is the practical one.
Why this case matters beyond Penang
The syndicate was not targeting Malaysians, and that is the part most local coverage skips past. What the raid shows is that Malaysia’s infrastructure – rented property, domestic internet, local banking rails – is being used as a base for fraud aimed elsewhere. That has consequences for how the country’s platforms and payment channels are regarded, and it is a reason the enforcement response extended to immigration offences alongside the cheating charges.
For ordinary users the lesson is narrower but more useful. The scam that reaches your phone will not arrive looking like a crime syndicate. It will arrive looking like a prize, a refund, or a delivery notice – and it will ask for a small payment to release something larger.
Sources
- The Star, “Penang cops nab 29 foreigners in ‘scratch-and-win’ scam raids”, 1 October 2026
- The Vibes, “Police bust online scratch and win scam syndicate operating from three luxury bungalows in Penang”, 1 October 2026
- Bernama, “Penang Police Bust International Scam Syndicate, Arrest 29 Foreigners”, 1 October 2026
- KPDN – consumer claim channels
