Malaysia Budget 2027 Puts RM72.1 Million Into Scam Prevention, School Safety and Data Protection

School education takes the largest share of digital safety funding

Malaysia's Budget 2027 sets aside RM72.1 million for online safety and personal data protection, with RM58.7 million going to the Safe Internet Campaign and RM5 million to an artificial intelligence application that would let people check suspicious telephone numbers, bank accounts and web links before paying.

The package also assigns RM5 million to improve police detection of online child sexual exploitation and RM3.4 million to strengthen personal data protection oversight. School education accounts for about 81 percent of the total, making prevention through learning the largest part of the spending plan.

The measures come after reported online scam losses reached RM5.37 billion between the beginning of 2024 and May 2026, according to Home Ministry figures. Investment scams accounted for RM2.68 billion, almost half of that amount, while telecommunications scams accounted for another RM1.54 billion.

Prime Minister and Finance Minister Anwar Ibrahim announced the proposed National Scam Response Centre (NSRC) application when tabling the budget in the Dewan Rakyat on October 9, 2026. Its purpose is to put a warning within reach at the moment someone is being asked to send money.

Home Minister Datuk Seri Saifuddin Nasution Ismail described the initiative in an October 12 National Security Council statement as part of efforts to strengthen commercial crime prevention, improve the NSRC's response and encourage safer digital habits. The government says users will be able to make preliminary checks before financial transactions.

For families, the package addresses connected problems: adults being pressured into transferring savings, children encountering exploitation online, and personal information being used to make fraudulent approaches sound convincing.

How the proposed scam checker would work

The NSRC application is intended to let users submit a suspicious telephone number, bank account or link and receive information about possible fraud risks. It would add a public tool to a response system that already brings together authorities and financial institutions.

Prof Dr Ainuddin Wahid Abdul Wahab, a fellow researcher at Universiti Malaya's Centre of Research for Cybersecurity and Network, described the proposed checker as a "traffic light" that could encourage users to pause before making a payment.

If the system gives an early warning, users have an opportunity to stop and verify the information.

AI can help search for patterns across large amounts of information, such as connections between suspicious transactions, accounts and links. Dr Aizat Khairi, a senior lecturer in Strategy and International Relations at Universiti Kebangsaan Malaysia, said such analysis could give the public warnings before financial losses occur.

Assoc Prof Dr Zubaile Abdullah, a senior researcher at Universiti Tun Hussein Onn Malaysia's Centre for Cybersecurity and Data Intelligence, identified a practical weakness: newly created accounts or telephone numbers may have no previous scam reports. Users would still need to verify who is requesting payment, especially when a message demands immediate action.

The budget presentation did not specify funding for the application, although the allocation breakdown assigns it RM5 million. A launch date, technical specifications and whether it will operate independently or alongside existing tools have not been announced.

What Malaysians can check already

The Royal Malaysia Police, known as PDRM, already operates Semak Mule. Members of the public can use it to check whether bank accounts, telephone numbers and company names have been associated with reported commercial crimes.

Bank Negara Malaysia's Financial Consumer Alert List serves a different purpose. It identifies entities or schemes that may have been wrongly presented as licensed or regulated. The Securities Commission Malaysia's Investor Alert List flags unauthorised entities and individuals.

Both regulators describe their lists as incomplete. Consumers checking an investment therefore need to establish its authorisation rather than relying solely on whether its name appears on an alert list. An account check and a check of regulatory status answer different questions.

The distinction matters in an investment scam. A promoter may direct someone to a polished website or messaging group filled with fabricated profit screenshots and testimonials, then ask for payment into a bank account. Checking the recipient account and checking the investment provider's authority address separate parts of that approach.

Losses rose sharply before the new proposal

Home Ministry figures put reported online scam losses at RM1.57 billion in 2024 and RM2.97 billion in 2025. The increase of RM1.4 billion amounts to about 89 percent in one year. Another RM830 million was recorded in the first five months of 2026.

Inspector-General of Police Tan Sri Mohd Khalid Ismail said on June 15 that the RM2.97 billion lost in 2025 worked out to more than RM8 million a day. Investment and telecommunications scams together accounted for RM4.22 billion of the RM5.37 billion recorded from January 2024 through May 2026, or about 79 percent.

The NSRC, which began operating in October 2022, handled 146,167 complaint calls and took action to freeze 138,915 accounts in 2025, according to Home Ministry figures. Those figures show the volume of reports and account interventions already passing through the system.

Deputy Home Minister Datuk Seri Dr Shamsul Anuar Nasarah said in February 2026 that the centre received 19,438 calls related to online scams in January. He also cited RM2.408 billion in victims' funds successfully frozen, with RM321.3 million, about 13 percent, returned to victims. Freezing money stops it from being moved while authorities work through the steps required for recovery.

The existing National Fraud Portal supports that work by bringing information together so authorities and financial institutions can trace funds and detect mule accounts. A mule account is used to receive or move criminal proceeds, making the money harder to follow.

Impersonation makes the pause before payment harder

Dr Noor Nirwandy Mat Noordin, a senior lecturer at Universiti Teknologi Mara's Centre for Media and Information Warfare Studies, warned that criminals are becoming more skilled at exploiting trust and creating urgency. Fabricated voices, AI generated videos and other synthetic material can make a request appear to come from someone familiar.

Nirwandy said automated approaches could be timed around paydays or festive celebrations. He called for quicker verification methods and greater care before sharing passwords or financial details.

Zubaile said leaked names, addresses and employment information can help criminals make their messages more believable. A person may lower their guard because the caller already knows something private about them.

"In this situation, scammers do not need to hack a victim's banking system. They only need to manipulate the victim into revealing confidential information or approving a financial transaction," he said.

Deputy Communications Minister Teo Nie Ching said on October 28 that MCMC had removed 170,633 items of online content connected to scams, including fake accounts and impersonation activity, as of October 15. Between February and August 2026, MCMC and telecommunications providers also blocked 101.66 million scam or spoofed calls through the Inter Operator Spoofing Gateway. Spoofing makes a call appear to originate from a different number.

Police analytics target child exploitation networks

Budget 2027 provides RM5 million to improve police detection of online child sexual exploitation, including an upgrade to the D11 division's Malaysia Internet Crime Against Children system, known as MICAC. The planned advanced analytics would help investigators identify perpetrators and connections within criminal networks.

Aizat said stronger analytical systems could help police connect suspects, networks and online exploitation activities more quickly. In practical terms, investigators would be looking for relationships across pieces of information that might otherwise be examined separately.

Aizat said success depends on the quality of information, the accuracy of analysis, international cooperation and protection of privacy. Investigators would still need to assess evidence and act on findings, supported by prompt enforcement and mechanisms to protect victims.

Child advocacy group Protect & Save The Children Malaysia, known as PS the Children, cited police figures recording 892 child sexual crime cases between January and October 2025. It also cited an interagency study estimating that about 100,000 Malaysian adolescents aged 12 to 17 experience online sexual exploitation annually, with half suffering in silence. The police figure counts recorded cases; the study estimates experiences across a wider population.

Schools receive RM58.7 million for internet safety

The Malaysian Communications and Multimedia Commission's Safe Internet Campaign aims to reach 400,000 students across 10,000 schools. Budget 2027 calls for stronger implementation in schools, focusing on cyberbullying and child exploitation.

The allocation places the largest share of the digital safety package in education. The campaign's student and school targets make its planned reach concrete, while the subject matter addresses risks children encounter on the same platforms they use to communicate and learn.

PS the Children welcomed the measures but called for dedicated, transparent funding to ensure delivery. Executive director Amnani Abdul Kadir said children need to recognise abuse, find accessible reporting channels and receive support after harm occurs.

"But technology alone cannot protect a child who does not know that what is happening to her is abuse," she said.

The group wants mandatory digital safety curricula, accountability for platforms and stronger mandatory background screening for people working with children. It also called for prevention, reporting and survivor recovery to receive equal funding priority.

Other child safety pledges include enforcement of the Online Safety Act and a RM100 million matching grant to train 6,000 caregivers. That grant sits alongside the RM72.1 million online safety and data protection package.

Data protection and rapid reporting complete the response

The RM3.4 million allocation for personal data protection oversight addresses information that can help criminals personalise an approach. Zubaile's warning about leaked names, addresses and employment details explains why protecting data matters alongside checking payments.

Malaysia Cyber Consumer Association president Siraj Jalil called for a tool that can read patterns as events happen. He also urged banks and telecommunications companies to share responsibility when safeguards fail, placing attention on the organisations that handle transactions and communications.

People who have already transferred money to a scammer are advised to contact their bank or the NSRC's 997 hotline immediately. Bank Negara Malaysia also advises victims to lodge a police report. A warning tool before payment and an emergency response after payment serve different stages of the same problem.

Ainuddin said technology and people need to form complementary layers of defence. Aizat similarly called for prompt enforcement and victim protection alongside analytical tools. Together, their recommendations place responsibility across public education, financial institutions, communications providers and investigators.

Parliament's next scrutiny comes in November

The proposals form part of a budget that has passed its policy vote in the Dewan Rakyat. MPs approved the Supply Bill 2027's broad direction on October 29, with committee scrutiny scheduled for November 2 to 26.

The main dates show how the digital safety proposals fit into the budget process:

• October 9, 2026: Anwar tabled Budget 2027 and announced the NSRC application.
• October 12: The National Security Council published the home minister's explanation of the proposed checks.
• October 28: Teo outlined scam content removals and blocked calls, and reaffirmed the application plan.
• October 29: The Dewan Rakyat approved the budget at the policy stage.
• November 2 to 26: MPs are scheduled to examine spending at the committee stage.

PS the Children's demand for transparent allocations gives that scrutiny a concrete focus: how much reaches prevention, reporting and recovery, and how the money is used. For the proposed application, the practical test will be whether timely warnings help people interrupt a fraudulent request before approving payment.

Key Points

• Budget 2027 allocates RM72.1 million across online safety and personal data protection measures.
• The Safe Internet Campaign receives RM58.7 million and targets 400,000 students across 10,000 schools.
• The proposed NSRC scam checker receives RM5 million to support checks of suspicious numbers, accounts and links.
• Police detection of online child sexual exploitation receives RM5 million, while data protection oversight receives RM3.4 million.
• Reported online scam losses totalled RM5.37 billion from January 2024 through May 2026.
• Victims are advised to contact their bank or 997 immediately and lodge a police report.
• Detailed parliamentary scrutiny is scheduled for November 2 to 26, 2026.