Malaysia Studies WhatsApp Identity Checks After 61 Arrests Over MCMC Impersonation Scams

WhatsApp checks proposed as scammers change tactics

Malaysia's Communications Ministry is studying whether WhatsApp should be required to verify the identities and telephone numbers linked to accounts, following police arrests of 61 suspects accused of impersonating Malaysian Communications and Multimedia Commission personnel in scams.

Communications Minister Fahmi Fadzil outlined the proposal at Razak Mansion in Kuala Lumpur on November 15, 2026. He said fraudsters had turned to WhatsApp and other methods after technical changes by the commission, known as MCMC, successfully restricted calls using falsified caller information.

The proposal remains under study. Fahmi gave no implementation date or details of the identity documents, checks or account procedures that might be required. For WhatsApp users, the immediate advice was to end suspicious calls and report suspected fraud, including through the National Scam Response Centre on 997.

Fahmi made the announcement while attending a pilot project for senior citizens living alone. That initiative will initially place monitoring technology in about 25 to 50 homes at Razak Mansion, with its cost and effectiveness assessed before any expansion.

What verification would involve

Fahmi said the ministry was examining checks on both the person using a WhatsApp account and the telephone number associated with it. He connected the review to concerns raised by other countries at the International Telecommunication Union, the international body through which governments discuss telecommunications matters.

The communications minister described the concern in these terms:

But recently, at the International Telecommunication Union (ITU), I heard many countries raise concerns about WhatsApp being misused for scam calls.

Identity verification means checking who a person is. Checking a telephone number concerns the number attached to an account. The practical requirements depend on how a system is designed, and the ministry has yet to set out that design.

Fahmi described WhatsApp's existing arrangements as having no account verification requirement. His proposal centres on strengthening the connection between an account, its number and its user, with the ministry still considering how such a requirement could operate.

Why blocking spoofed calls led to another response

MCMC had already introduced technical changes to restrict caller ID spoofing, Fahmi said. Spoofing involves falsifying the caller information shown to the recipient, making a call appear to come from a different number or organisation.

A person receiving such a call may see something that looks familiar or official on the screen. That appearance can help a scammer begin a conversation about a supposed debt, investigation or urgent problem.

Fahmi said the technical changes had successfully restricted spoofed calls, after which scam syndicates shifted to other methods. He identified WhatsApp scams and offers of loans for online gambling among the tactics now being used.

The ministry is therefore looking at further measures within communications networks as well as possible account checks. Fahmi, explaining the work under consideration, said:

At the network level, several matters are being studied,

The change in tactics explains why the ministry is considering more than one response. Restricting false caller information addresses one route to a victim; impersonation through a messaging account creates another route that requires attention to the account and the person using it.

What the 61 arrests mean for enforcement

Police recently arrested 61 suspects over alleged impersonation of MCMC personnel. Fahmi was responding to questions about those arrests when he discussed the proposed WhatsApp checks and the government's further action against scams.

Fahmi said suspects would be arrested, detained and investigated, and could be charged in court if they were found to have broken the law. The account checks are a separate proposal being examined alongside that enforcement work.

The number of arrests gives a measure of the police operation. The announcement provided no total for victims or financial losses associated with those cases, leaving the scale of the alleged harm unspecified.

MCMC's name is central to the alleged deception. A caller claiming to represent a communications regulator can make a telephone problem sound like an official enforcement matter. Fahmi's warning addressed that claim directly by explaining which organisation actually handles telephone bills.

Who handles an unpaid telephone bill?

Telecommunications companies, rather than MCMC or the Communications Ministry, handle their customers' billing matters, Fahmi said. He warned that the ministry and commission do not call members of the public about outstanding telephone bills or make outgoing calls for enforcement purposes.

Fahmi said people had complained about callers claiming to represent MCMC and warning them about unpaid bills. The communications minister explained the division of responsibility:

MCMC does not handle such matters. That is the responsibility of the telecommunications companies themselves,

A warning that a telephone line will be disconnected can put a recipient under pressure to act quickly. Fahmi's explanation gives people a concrete way to recognise the impersonation: a caller presenting an unpaid telecommunications bill as an MCMC enforcement issue is using a responsibility the regulator does not have.

Fahmi advised recipients to end suspicious calls immediately and report them to the police or MCMC. He also directed people to the National Scam Response Centre at 997, which coordinates rapid responses to online financial fraud.

The reporting options serve different needs within the response to scams. Police investigate suspected offences, while the national centre brings together the response to online financial fraud. For a person confronted with an urgent demand from a supposed official, the minister's first instruction was simple: end the suspicious call.

A second WhatsApp warning within days

Malaysia's consideration of account checks follows a warning about malicious attachments published on November 8. That warning concerned suspicious ZIP files, links and documents sent through WhatsApp, including files made to look like invoices, account statements and payment documents.

MCMC's security notice dated November 4 urged users to verify unexpected files with their senders and check WhatsApp's Linked Devices list for connections they did not recognise. Related cybersecurity warnings described malicious files targeting Windows computers and scripts distributed through WhatsApp Web.

The developments have unfolded in this order:

• October 29: MyCERT warned of a campaign distributing malicious files disguised as financial and payment documents through WhatsApp.
• November 4: MCMC issued a security notice about suspicious ZIP archives, attachments and links.
• November 8: Deputy Communications Minister Teo Nie Ching called for stronger digital literacy as attention focused on malicious attachments and account takeovers.
• November 15: Fahmi outlined the study of WhatsApp identity and telephone number checks after the arrests involving alleged MCMC impersonation.

The warnings describe different points at which criminals approach users. A fraudulent caller may rely on an official title and an urgent demand. A malicious attachment may arrive through an account displaying a familiar person's name and photograph, including an account that criminals have taken over.

Razak Mansion pilot will begin with 25 to 50 homes

The event where Fahmi discussed scams also introduced a separate safety initiative for senior citizens living alone at Razak Mansion. The Communications Ministry is working with the Federal Territories Department and Kuala Lumpur City Hall on the Senior Citizens' Safety System Pilot Project.

The initial installation will cover about 25 to 50 residential units. The upper end of that range is twice the lower end, showing that the starting scale remains flexible while the project is prepared and assessed.

Minister in the Prime Minister's Department for Federal Territories Hannah Yeoh and Kuala Lumpur Mayor Fadlun Mak Ujud attended the press conference. Fahmi said the government would evaluate the monitoring technology's cost and effectiveness before considering other locations with similar needs.

The pilot and the proposed WhatsApp checks are at different stages and address different problems. Residents at Razak Mansion are the intended recipients of a local monitoring project, while messaging users across Malaysia are awaiting the outcome of a national feasibility study. The next stated steps are an assessment of the pilot and continued examination of the account verification proposal.

Key Points

• Malaysia is studying identity and telephone number checks for WhatsApp accounts; no implementation date was announced.
• Police arrested 61 suspects over alleged impersonation of MCMC personnel in scams.
• Fahmi said scammers changed tactics after MCMC restricted spoofed calls.
• Telephone companies handle unpaid bills. Fahmi warned that MCMC and the ministry do not call the public about such bills or enforcement matters.
• People receiving suspicious calls were advised to hang up and report them to police, MCMC or the National Scam Response Centre at 997.
• A separate safety pilot will initially install monitoring technology in about 25 to 50 homes for senior citizens living alone at Razak Mansion.