Kathreena Korotana highlights the key options available to victims of cyber scams.

Cyber scams have been a global rampant concern over the years, especially with the advancement of technology and expansion in the digitalisation of economy. Whilst such growth has benefitted society, it unfortunately creates a conducive environment for cybercriminals to thrive in, reaping its benefits of the vulnerable digital world. Cyber scammers usually swindle their victims for financial gain, whether by stealing money or personal data. Being a nation that has been making huge progress in the digitalisation of economy, Malaysia is no exception to cyber scams and has reported 12,092 online scams over the first half of 2022 with losses amounting up to RM414.8 million (approx. USD93 million).

Recourses

If you find yourself falling into the traps of these cyber scammers, below are some of the salient recourses that you can turn to:

1. National Scam Response Centre (NSRC)

   As your first point of redress, you are highly encouraged to contact the NSRC hotline at 997 to lodge a complaint on the incident. NSRC has recently been established as a command centre to coordinate rapid responses for cyber financial scams, including phishing scams, malware attack scams, parcel scams, love scams and package delivery scams, which encompass coordinating faster tracking of stolen funds and enforcement action against these cyber scammers. Upon receiving the complaint, NSRC will coordinate with financial institutions, telecommunication companies and other enforcement agencies to investigate the scam as well as help prevent additional losses for the victim. While there is no guarantee that NSRC will be able to facilitate the return of every cent lost, quick action is essential for better outcome. Therefore, victims are encouraged to contact NSRC immediately for effective actions by NSRC such as freezing your bank account.

2. Banks

   If the scam involves money being stolen from your bank account, you should make a report to the relevant bank of the compromised account by calling its emergency response hotline to freeze your account or reverse the transaction. However, if you previously made a report about the scam to NSRC, there is no real need to make a separate report with your bank as NSRC will liaise with your bank as necessary. This applies vice versa.

3. Police (PDRM)

   In addition to alerting NSRC or your bank, you must make a police report as soon as possible for record purposes and to allow the authorities to launch a formal investigation. The information to be provided to the police would be the same as provided to NSRC or the bank. However, you should also supply any evidence relating to the scam to PDRM, such as communications with scammers, transaction receipts, website addresses shared by scammers to name a few.

4. Malaysian Communications and Multimedia Commission (MCMC)

   For cyber scams involving data theft, phishing scams or other incidents of a similar nature, you can consider making a complaint with MCMC. MCMC is the regulator for the communications and multimedia industry in Malaysia and handles various matters pertaining to digital content and security issues, including online scams. To make a complaint to MCMC, you can either do so via their MCMC complaint portal at https://aduan.skmm.gov.my/ or email aduanskmm@mcmc.gov.my. Detailed information and supporting documents about the scam are needed so it is prudent to collect as much evidence as you can. MCMC will thereafter proceed with investigations on the complaint.

5. Malaysian Computer Emergency Response Team (MyCERT)

   MyCERT was established to assist the public with computer security incidents. It operates Cyber999 which provides emergency response on not only online scams but any computer security related matters such as phishing attacks, cyber harassment, malware, hacking attempts, identity theft and other security breaches. To make an official complaint, you can either download the (1) Cyber999 app on your mobile; (2) fill in a form on MyCERT’s online portal; (3) send an email to cyber999@cybersecurity.my; or (4) phone its hotline at 1-300-88-2999. Upon receipt of the complaint, MyCERT will proceed to investigate the same.

6. Ministry of Domestic Trade and Cost of Living (MDT)

   For consumer-related scams, complaints are usually directed to MDT, which is a ministry established to promote the growth of ethical domestic trade and consumer interests. For instance, you have made an online purchase based on an item listing that looks genuine. However, after making such purchase, you realise that days go by, and you have yet to receive your item. You soon find out that the listing has been removed and the seller is uncontactable or has simply vanished. Such situation would be regarded as a consumer-related scam and MDT can assist you with investigating the case. You can make the complaint to MDT through the following avenues: (1) MDT’s consumer complaints portal, eAduan KPDN on their website: https://eaduan.kpdn.gov.my/kepenggunaan; (2) the ezAdu mobile app; (3) WhatsApp at 019-2794317; or (4) write in to them at e-duan@kpdnhep.gov.my.

The Civil Route - Getting the Courts Involved

Apart from the above administrative routes, another option would be to file civil proceedings against the scammer. To proceed with this option, sufficient details and evidence about the scam as well as the identity of the scammer are necessary. Depending on the nature of the scam, you may be able to bring other parties as co-defendants to your suit if there are sufficient grounds to do so (i.e. banks, e-commerce platforms, etc.). However, this is subject to the circumstances of the case and other legal considerations.

Whilst the civil option is available, it is pivotal to note that for cyber scams involving monetary loss, there is no guarantee that you will be able to recover the full amount despite obtaining a successful judgment against the scammer. Further, legal suits can be time consuming and costly. One of the most frequent difficulties faced by victims that could hinder them from filing lawsuits is identifying or locating the scammers as most scammers are phantoms who go to great lengths to conceal their identity.

Spartacus Order – a saving grace?

As identifying these scammers are often a prevalent difficulty, a recent landmark decision in the case of Zschimmer & Schwarz Gmbh & Co Kg Chemische Fabriken v Persons Unknown & Anor [2021] 7 MLJ 178 (“the Case”) has brought hope to many cyber scam victims of unidentifiable attackers.

In the Case, the High Court granted a Spartacus Order, known as a self-identification order, to compel an unknown defendant to identify themselves and provide an address of service. The Plaintiff was a victim of a push payment fraud. The persons unknown, that is the 1st Defendant, deceived the Plaintiff into paying approximately close to RM600,000 (approx. USD205,000) to a Malaysian bank account, whereby the persons unknown was in control of the bank account. The Plaintiff then sued the persons unknown as the 1st Defendant and the bank account owner as the 2nd Defendant to recover the financial loss. The Court heavily referred to the English case of PML v Person(s) Unknown [2018] EWHC 838 in reaching its decision to grant a Spartacus Order by stating that the purpose of the self-identification order is to protect the Plaintiff’s rights if the Plaintiff were to succeed. The Court acknowledged that the Defendant may not comply with the self-identification order but this cannot always be assumed as only few defendants can remain confident that they will ultimately manage to evade identification. In essence, this is to assist in identifying the unknown fraudsters.

As there are no other cases to-date that followed the footsteps of the Case by granting a Spartacus Order to identify an unknown defendant, it is difficult to determine the efficacy of these Spartacus Orders in identifying unknown fraudsters in Malaysia at this stage. However, the decision of this Case itself is a right step moving forward in preserving the interest of justice of these victims and hopefully assisting them in tracing their perpetrators. It is important to note that these Spartacus Orders can extend its application to other anonymous perpetrators such as blackmailers.

Conclusion

Following the recourses mentioned above, the key element is to act quickly for better chances of financial recovery and better outcome of investigations to prosecute these scammers. Despite the various recourses available, a police report should always be made hand in hand with complaints to other authorities highlighted above.

Ultimately, as the saying goes, prevention is better than cure. Even though it might be difficult to totally eliminate yourself from being a victim of a cyber scam, there are proactive steps that you can take to minimise the chances. First, being educated and aware of cyber scams and the progression of the same is prudent. Exercising mindfulness is encouraged when dealing with personal information over the phone or internet or responding to dodgy e-mails and texts claiming to be from official authorities or financial institutions. Second, practising good cyber hygiene is also important such as using strong passwords for your online accounts and ensuring these passwords are changed regularly, checking the authenticity of unfamiliar emails, refraining from clicking suspicious links and performing data backups regularly, especially of important and confidential information.

Kathreena is an Associate at Wong Jin Nee & Teo. Her practice predominantly focuses on brand protection and enforcement, franchise advisory and registration, as well as regulatory compliance work.