A company in Kuching lost RM327,000 in two bank transfers after an employee received a WhatsApp message from someone claiming to be the company director. Kuching district police chief ACP Alexson Naga Chabu confirmed the case on 15 October 2026, and two independent Malaysian outlets reported it within 24 hours: an English-language daily and a Chinese-language daily, both carrying the same police statement. WhatsApp scam Malaysia cases rarely come with this much operational detail, and the detail is the useful part: this was not a clever technical attack. It was an authorisation that nobody checked.
What makes it worth an SME’s attention is the sequence. The employee did not act alone. She told the accountant. The accountant arranged the transfer. Two payments left the company. Only afterwards, when the accountant reviewed the outgoing funds and found the recipient names suspicious, did anyone call the director. He said he had never asked for anything.
Last updated: 18 October 2026. This article reports a statement by the Kuching district police chief as carried by two independent Malaysian outlets on 15 and 16 October 2026, plus the police’s own published guidance. The company and the employee are not named, and we do not identify them.
WhatsApp scam Malaysia: how RM327,000 left in two transfers
The mechanics, in the order the police described them. An employee aged 26, working at a company in Kuching, received a WhatsApp message during the working day on Thursday 15 October. Police recorded the message as coming from the number 017-3379405. The sender said he was the company director and instructed her to transfer company funds online as an advance payment to renew a new contract.
She passed the instruction to the company’s accountant, who arranged the transfer as instructed. Two transactions went to two different bank accounts. Once they had cleared, the accountant reviewed the outgoing funds, found the recipients’ names suspicious, and contacted the actual director to verify. He denied any involvement. The company then realised it had been defrauded of RM327,000.
| Stage | What happened | Where a control existed, and did not fire |
|---|---|---|
| The instruction | A WhatsApp message from an unknown number claimed to be the director and asked for an advance payment to renew a contract | No callback to a known director number before acting on the message |
| The hand-off | The employee passed the instruction to the accountant, who arranged the transfer | Passing an instruction along is not verifying it. Two people executed one unverified request |
| The transfers | Two payments, to two different bank accounts | Two separate payees for one contract is the anomaly that should have stopped the second payment |
| The catch | The accountant reviewed the outgoing funds, found the recipient names suspicious, and called the director | The check happened after the money left, not before |
Sequence as described by Kuching district police chief ACP Alexson Naga Chabu, reported on 15 and 16 October 2026. Source: DayakDaily, Fake boss, real loss: Scammer poses as director, swindles Kuching firm of RM327,000, 16 October 2026, dayakdaily.com.
A smartphone home screen showing the WhatsApp app icon. The Kuching case began with a WhatsApp message from an unknown number claiming to be the company director. Photo: Yuri Samoilov, CC BY 2.0, via Wikimedia Commons. This is an illustrative photograph, not a picture of the device or the message in this case.
The three controls that would have stopped it
None of these is novel, and that is the point. The case is not a story about a sophisticated fraud. It is a story about three ordinary controls that were absent at the moment they were needed.
One: a callback to a number you already hold. The instruction arrived on a channel the company did not control, from a number it had never used for that person. A callback to the director’s number already in the company’s records, not the one in the message, would have ended the attempt immediately. This is the single cheapest control and it is the one that was missing.
Two: a rule that a payment instruction is never actioned on the strength of a message. The employee did the conscientious thing. She escalated to the accountant. But the escalation moved the instruction along rather than testing it, so two people ended up executing one unverified request. The rule has to be explicit: a message can initiate a payment, only a verified conversation can authorise one.
Three: a second look at the payee. One contract, two payees, two banks. That pattern alone is a reason to stop. A payment approval process that checks the amount but not who is being paid will pass both transfers.
What the police actually told the public to do
ACP Alexson’s advice, as reported, is narrower than the general “beware of scams” message. End suspicious calls immediately. Do not disclose personal or banking information to unknown callers. And verify payment requests before transferring money to third parties.
He pointed the public to two specific tools. The first is Semak Mule, the Royal Malaysia Police portal where you can check a bank account number or a telephone number against records of accounts reported in commercial crime cases. The second is the National Scam Response Centre (NSRC) hotline at 997, which runs 24 hours a day. For Sarawak specifically, the state Commercial Crime Investigation Department also runs a hotline at 011-62890089.
The Semak Mule portal, captured 18 October 2026. Set the category to No Akaun Bank, enter the account number you have been given, and press SEMAK before you release a payment. Source: Polis Diraja Malaysia, Commercial Crime Investigation Department, semakmule.rmp.gov.my.
Why “the director asked me” is the weakest possible authorisation
An SME has a structural weakness that larger firms do not: the person who knows the director is often the same person who can authorise a payment, and the director is often reachable only by phone. That is efficient ninety-nine times out of a hundred, and it is exactly the condition this fraud is built for.
The defence is not suspicion of colleagues. It is a written rule that identity is verified through a channel the company controls, not through the channel the request arrived on. Written down, it is one sentence. Unwritten, it is a judgement call made by a 26-year-old during a working day, under a message that appeared to come from the boss.
There is a second, quieter lesson in the timeline. The fraud was caught by the accountant reviewing where the money went, which is a control that works but works too late. Moving that same review to before the transfer turns a detection into a prevention, and costs nothing.
What to change in your payment process this week
- Name a call-back rule in writing. Any payment request received by message gets verified by a call to a number already on file, never to a number supplied in the message.
- Require a second approver for any new payee. The first payment to a new account is the one that carries the risk, so it gets the second signature.
- Check the payee on Semak Mule before releasing funds. Account number and phone number. A clean result is not proof of legitimacy, because accounts are opened and abandoned constantly, but a hit is a stop.
- Brief finance and admin staff by name. The people who can move money, not the whole company. Include the sentence: no transfer on a WhatsApp or email instruction alone, ever.
- Test it once. Send a finance colleague a fake payment instruction from a personal number this month and see whether anyone calls back. A control nobody has exercised is an assumption.
- Put 997 and your state CCID hotline in the finance folder. Speed matters: the faster a report is made, the better the chance a bank can act on the receiving account.
What we could and could not confirm
Confirmed, from the police statement as carried by two independent outlets: the date of the incident, the amount of RM327,000, the two transfers to two different accounts, the sequence in which the employee and the accountant acted, that the director denied involvement, and that the case is being investigated under Section 420 of the Penal Code, which on conviction carries between one and 10 years’ imprisonment, whipping, and a possible fine.
Not confirmed, and we are not going to guess: whether any of the money has been recovered or frozen, whether anyone has been arrested, the identity of the account holders, and whether the WhatsApp number was operated by the person who benefits from the transfers. We also could not confirm how the sender knew the employee’s role or the company’s contract cycle, which is the detail that would tell you whether this was a targeted approach or a broadcast attempt that happened to land.
One editorial choice worth stating. Police published the telephone number the message came from, and it is reported above because it is part of the official record. Numbers are recycled and can be spoofed, so do not treat a number as an identity of a person, and do not contact it. Use Semak Mule, which checks records rather than reputations.
Frequently asked questions
What happened in the Kuching WhatsApp scam case?
A 26-year-old employee at a Kuching company received a WhatsApp message from an unknown number claiming to be the company director, instructing an advance payment to renew a contract. She passed it to the accountant, who arranged two transfers to two different bank accounts. The company lost RM327,000 before the accountant checked with the real director, who denied any involvement.
Was this a hack, or a fraud?
A fraud. There is no indication of any system being breached. The message was a request, and it was authorised by people who had no way of confirming who sent it. Nothing in the reporting suggests the company’s banking or email systems were compromised.
How do I check if a bank account has been reported for scams?
Use Semak Mule, the Royal Malaysia Police portal at semakmule.rmp.gov.my. Select the bank account category, enter the account number, and submit. A hit tells you the account appears in police records; no hit does not certify that an account is safe.
What is the 997 hotline?
997 is the National Scam Response Centre hotline, which operates 24 hours a day. It is the line to call when a scam has just happened and speed matters, because a fast report gives banks the best chance of acting on the receiving account. For Sarawak, the state Commercial Crime Investigation Department also publishes a hotline, 011-62890089.
Does a WhatsApp message from my director count as authorisation?
It should not, and that is the change this case argues for. A message can start a payment, but the authorisation should come from a conversation you initiated on a number you already hold. Write that rule down, because the alternative is the judgement of whoever receives the message.
Is this common in Malaysia?
Impersonation of a senior person to induce a transfer, sometimes called a boss scam, is a recognised pattern and not specific to Malaysia. The reported losses in this case are large because a company can move a company-sized sum; the method is a message and a phone. We have covered a similar consumer pattern in the ticket tout scam we reported in October, and the mechanism is the same: an unofficial channel that looks faster than the official one.
Sources
These are the reports we read, with the date each was published.
- DayakDaily, Fake boss, real loss: Scammer poses as director, swindles Kuching firm of RM327,000, 16 October 2026 (the police statement by Kuching district police chief ACP Alexson Naga Chabu; the sequence; the amount; Section 420; the Semak Mule and 997 guidance) — dayakdaily.com
- See Hua Daily News, report on the same Kuching police statement, 15 October 2026 (independent confirmation of the amount, the two transfers, the section charged and the police advice) — news.seehua.com
- Polis Diraja Malaysia, Commercial Crime Investigation Department, Semak Mule portal, accessed 18 October 2026 (the account and telephone number check described in this article) — semakmule.rmp.gov.my
- Wikimedia Commons, Whatsapp app icon on smartphone screen (perspective render), photograph by Yuri Samoilov, CC BY 2.0 (the illustrative phone photograph; not the device or message in this case) — commons.wikimedia.org
- Wikimedia Commons, Businesswoman making a payment with cash while using a smartphone in a modern office setting, CC BY 2.0 (the cover photograph; illustrative only) — commons.wikimedia.org
- Own capture, 18 October 2026: the Semak Mule portal, retrieved over HTTPS and cropped to the search form. Read-only; nothing on the portal was submitted or changed.
BD Media is the editorial desk of Big Domain. This article reports a police statement as carried by two independent Malaysian outlets and the police’s own published guidance. It is not legal advice. We have not named the company or the employee, and no detail here should be used to try to identify them.
