Johor Baru Retired Bank Manager Macau Scam (RM936,000)

What Happened

In Johor Baru, Malaysia, a 60-year-old retired bank manager lost RM936,000 to a "Macau scam" vishing syndicate over a roughly six-week period beginning 1 April 2026. She received a call from a man posing as an insurance agent who claimed a fraudulent medical insurance claim had been filed in her name at a Kuala Lumpur hospital; the call was handed off to a second man posing as a police officer who told her she was under investigation for money laundering and had her file an online police report; a third caller, posing as a deputy public prosecutor, then instructed her to open a new bank account "for investigation purposes." On 6 April 2026 she opened the account, transferred all her savings into it, and also gave the scammers her online banking login credentials. On 15 May 2026 she discovered the money had been withdrawn and filed a police report. Johor Baru (South) police chief Assistant Commissioner Raub Selamat detailed the case in a public statement on 20 May 2026, confirming the case is being investigated under Section 420 of the Penal Code (cheating) and warning the public never to disclose banking details or transfer funds to unknown callers, even those claiming to be law enforcement.

How the Attack Worked

The syndicate ran a three-stage relay/handoff vishing script typical of Malaysia's "Macau scam": (1) an initial caller posing as a medical insurance agent told the victim a fraudulent claim had been filed in her name at a Kuala Lumpur hospital, creating a plausible, personally-relevant hook and establishing that "someone is using your identity"; (2) the call was transferred live to a second caller posing as a police officer, who escalated the fear by accusing her of being under investigation for money laundering and instructing her to file an online police report (a step that both looks like due diligence and locks the victim into the fictitious legal narrative); (3) a third caller, posing as a deputy public prosecutor and invoking a real, authoritative government legal office, instructed her to open a brand-new bank account "for investigation purposes," ostensibly to protect/quarantine her funds from the fraud being investigated. She opened the account on 6 April 2026, transferred her entire savings into it, and, still following "investigative" instructions, handed over her online banking login credentials to the callers. The scammers then drained the account; she did not discover the loss until 15 May 2026, more than five weeks after the funds were moved, when she checked the account. The chain worked because each caller escalated authority (agent -> police -> prosecutor) while keeping the victim on a single continuous, uninterrupted call/handoff, denying her time to consult family, her bank, or real authorities, and because the final instruction (moving money into a "safe" account under legal orders) mimics real asset-freeze procedures victims may have heard about.

The Lure & the Tell

Lure: a call from a purported insurance agent alleging a fraudulent medical claim filed in the victim's name, followed by escalating handoffs to a "police officer" alleging a money-laundering investigation and finally a "deputy public prosecutor" directing her to open a new account and surrender banking credentials "for investigation purposes." Tell (in hindsight): no genuine Malaysian police officer, prosecutor, or insurer conducts an investigation by directing a private citizen to open a new bank account, transfer savings into it, or disclose online banking passwords over an unsolicited phone call; legitimate authorities communicate via official written notices/summons and never ask for credentials or fund transfers by phone.

Outcome

Total loss of RM936,000; the victim's funds were withdrawn by the syndicate before she discovered the theft on 15 May 2026 and filed a police report. Johor Baru (South) police confirmed the case is being investigated under Section 420 of the Malaysian Penal Code (cheating). As of the police statement on 20 May 2026, no arrests, asset recovery, or prosecution outcomes had been reported.

Why It Matters

The case is a textbook illustration of Malaysia's prevalent "Macau scam" vishing pattern (relay/handoff calls escalating from a plausible commercial pretext to impersonated police and prosecutorial authority) and is notable for its irony: the victim was herself a retired bank manager, demonstrating that financial-industry expertise and seniority offer no inherent immunity against sustained, escalating social-engineering pressure that exploits fear of legal jeopardy rather than financial naivety. It also underscores a durable core vulnerability: no legitimate government investigation ever requires a citizen to open a new account, move savings into it, or surrender online banking credentials by phone, yet these specific asks remain effective when wrapped in successive authority impersonation.

Defenses

Royal Malaysia Police (Johor Baru South chief ACP Raub Selamat) issued a public statement/warning after the fact, reminding the public never to disclose banking information or transfer money to unknown parties even when callers claim to be from enforcement/prosecution agencies, and to independently verify any claim of a criminal investigation via official channels rather than acting on instructions received over an unsolicited call. No technical control stopped this attack; the case was only caught after the money was already withdrawn, when the victim checked her account balance and then filed a police report. Broader Malaysian public-awareness efforts (e.g., MCPF Penang's republication of the case) aim to pre-empt similar "Macau scam" calls by educating the public that police and prosecutors never conduct investigations by asking victims to open new bank accounts or transfer savings by phone.