WhatsApp Boss Scam Costs Terengganu Car Dealership RM452,000
A car dealership in Terengganu lost RM452,000 after staff fell victim to a WhatsApp "boss" scam, where fraudsters impersonated the company owner and instructed employees to make urgent fund transfers. The case was reported by Malay Mail and highlights the growing threat of business impersonation fraud targeting Malaysian SMEs.
The WhatsApp boss scam is a localised variant of business email compromise (BEC), adapted for the messaging platforms widely used across Malaysian businesses. Unlike traditional BEC which targets corporate email, this version exploits the trust and immediacy of WhatsApp communication.
Scammers create a WhatsApp account using the boss's name and profile photo, which can be easily copied from social media or company websites. They then contact an employee — typically in finance or accounts — with an urgent request to transfer funds to a third-party account.
The messages often include pressure tactics: "Do this immediately," "I'm in a meeting and can't call," or "This is confidential, don't tell anyone else." The sense of urgency and authority prevents the employee from questioning the request or verifying through other channels.
In some cases, scammers first research the company's structure through LinkedIn, company websites, or social media to identify the right people to target and the language patterns the boss typically uses.
How common are WhatsApp boss scams in Malaysia?
WhatsApp boss scams are an increasingly common variant of business impersonation fraud in Malaysia, targeting SMEs where financial controls may be less formal. Losses per incident often reach hundreds of thousands of ringgit.
How do I report a WhatsApp boss scam in Malaysia?
Call 997 (NSRC), lodge a police report, report via SemakMule at semakmule.rmp.gov.my, and alert your bank immediately to attempt a fund recall.
⚠ Red Flags
- !New or unfamiliar WhatsApp number — The message comes from a number not previously used by the boss, even though the name and photo match.
- !Urgent payment requests — The "boss" demands immediate transfer to an unfamiliar account, often citing a deal closing or a supplier payment.
- !Secrecy instructions — You are told not to discuss the transfer with colleagues or other management.
- !Excuses to avoid calls — The scammer claims to be in a meeting, overseas, or otherwise unable to speak by phone.
- !Third-party accounts — The payment is directed to a personal account rather than a known supplier or company account.
🛡 How to Protect Yourself
- 1Always verify payment instructions by calling the boss directly on their known phone number
- 2Implement a dual-approval policy for all fund transfers above a set threshold
📞 How to Report
- 1Call 997 (National Scam Response Centre) immediately if a suspicious transfer has been made
- 2Lodge a police report at your nearest station
- 3Report via SemakMule (semakmule.rmp.gov.my) to flag the recipient account
Want to learn more?
Book a scam awareness workshop for your family, community group, or organisation.
View Anti-Scam Programme