The Malaysian government has initiated a comprehensive study aimed at fortifying the legal safeguards available to victims of cybercrime, reflecting growing concerns about the vulnerability of online scam sufferers under current legislation. Datuk Seri Azalina Othman Said, the Minister in the Prime Minister's Department (Law and Institutional Reform), unveiled the initiative after attending the National Cyber Security Summit (NCSS) 2026 in Putrajaya, signalling heightened government attention to an issue that has become increasingly urgent as digital fraud cases multiply across the nation.
The Legal Affairs Division (BHEUU) is spearheading the examination, tasked with developing a more robust framework that addresses multiple dimensions of victim welfare. Beyond simply prosecuting offenders, the study will investigate mechanisms to help individuals recover funds lost to online scams—a critical gap in Malaysia's existing approach where many victims receive no restitution despite reporting crimes to authorities. This dual focus on prevention and remedy represents a shift from the country's traditional emphasis on criminal penalties alone.
A central component of the investigation involves reviewing international approaches that have proven effective in protecting victims' interests. Singapore's use of caning as a supplementary penalty for cybercriminals exemplifies the stricter enforcement models under consideration, contrasting sharply with Malaysia's current reliance on fines and custodial sentences. By examining how different jurisdictions balance deterrence with victim restitution, Malaysian policymakers seek to identify transferable practices that would enhance both the severity of consequences and the prospects for recovery.
The United Kingdom and Australia represent particularly instructive case studies within the research scope. Both nations have implemented mechanisms requiring banks to refund customers who fall victim to online scams under specific circumstances—a protective measure that has proven effective in shifting financial responsibility away from individuals and toward institutions better positioned to absorb losses and prevent future fraud. These systems essentially create a safety net for victims, ensuring they do not bear the entire burden of criminal activity beyond their control.
Malaysia's banking sector has not yet committed to adopting similar mandatory refund schemes, though Bank Negara Malaysia is reportedly considering the possibility as part of the ongoing governmental review. This hesitation reflects the complexity of implementing such systems, which require coordination between regulators, financial institutions, and law enforcement agencies to establish clear criteria for eligibility, verification procedures, and recovery timelines. The deliberation underscores the tension between protecting consumers and managing banks' operational costs.
Azalina emphasised that Malaysia's existing legal framework, predominantly structured around the Penal Code and Criminal Procedure Code, concentrates primarily on identifying and punishing offenders rather than systematically supporting victims throughout their recovery journey. While criminal prosecution remains essential for deterrence, the current architecture leaves victims with limited recourse beyond filing initial reports—a structural weakness that the BHEUU study aims to rectify. This acknowledgement suggests recognition within government circles that criminology alone cannot adequately address the human consequences of digital fraud.
The vulnerability of online scam victims in Malaysia reflects broader regional challenges as cybercriminals exploit technological sophistication and social engineering to target increasingly diverse populations. Unlike traditional crimes with visible evidence, online fraud operates across jurisdictional boundaries and often involves complex international money laundering networks that complicate recovery efforts. Malaysian victims frequently discover that pursuing civil remedies proves prohibitively expensive and time-consuming, leading many to abandon recovery attempts entirely.
The government's investigation will necessarily examine not only statutory penalties but also institutional mechanisms for victim support—including counselling services, legal aid provisions, and financial assistance programmes that some nations have established. The psychological and economic trauma experienced by scam victims extends beyond immediate monetary loss, affecting mental health and financial stability for extended periods. Comprehensive victim protection therefore requires holistic approaches addressing both immediate recovery and longer-term rehabilitation.
Timing for completion of the BHEUU study remains undetermined, reflecting the thoroughness intended in the examination. Rather than implementing hastily conceived reforms, the government appears committed to evidence-based policymaking that considers international lessons, domestic feasibility, and coordination requirements among multiple stakeholders. This methodical approach, while potentially frustrating to victims seeking immediate relief, may ultimately produce more durable and effective protections.
For Malaysian citizens increasingly exposed to sophisticated online fraud schemes, the initiation of this study signals governmental acknowledgement of their vulnerability and commitment to systemic reform. However, meaningful progress will depend on whether recommendations are subsequently translated into legislative action and whether financial institutions ultimately embrace victim-protective measures that increase their operational responsibilities. The outcome will likely influence regional approaches, as other Southeast Asian nations grapple with similar cybercrime challenges and victim protection gaps.
