Common warning signs of a scam website

Stop at the payment beneficiary

A seller or investment operator asking for transfer to an unrelated personal account is a major warning. Verify the account or phone number through PDRM’s Semak Mule and confirm payment instructions through independently sourced contact details.

Check the identity outside the website

• Search the exact legal business name and registration information.
• Type the known official domain yourself instead of following an advert or message link.
• For investments, use the SC Investment Checker and Investor Alert List.
• For financial-services claims, check BNM’s Financial Consumer Alert List.
• Call a published official number to verify unusual payment or account instructions.

Look beyond the padlock

HTTPS only encrypts the connection; scammers can obtain certificates. Treat a newly changed domain, copied policies, broken social links, impossible discounts, countdown pressure, no physical identity and bank-transfer-only checkout as signals that require more checking.

Do not install the seller’s software

A legitimate purchase does not require remote-access software, an Android package sent in chat or screen sharing of banking activity. Stop if a caller asks for an OTP, PIN, password or card security code.

If you paid or entered credentials

Use the bank’s official contact immediately, call NSRC 997, change exposed passwords from a clean device and preserve the URL, messages, account number and transaction record. Do not warn the scammer before trying to secure funds and accounts.