Not A Fake Number — Hacked Phone: How A Clerk Was Fooled Into Transferring RM970,000
A Tanjung Malim company lost RM970,000 after a scammer hacked its manager’s phone and used the real number to order a clerk to transfer funds — three times.
- A clerk transferred RM970,000 after receiving WhatsApp instructions from her manager's hacked phone, with the scammer impersonating him convincingly.
- Scammers gain full account access via OTP theft, malware, or SIM-swap fraud, making messages appear completely legitimate to recipients.
Subscribe to our FREE Newsletter, or Telegram and WhatsApp channels for the latest stories and updates.
When a clerk at a Tanjung Malim company received a WhatsApp message from her manager’s number instructing her to transfer funds, everything looked legitimate — the name, the profile, the number.
It wasn’t her manager.
It was a scammer who had hacked his phone.
The 31-year-old clerk made three transfers into two bank accounts, totalling about RM970,000, before the requests kept coming — and something felt wrong.
She called her manager directly.
He had sent no such instructions.
Muallim OCPD Supt Khalid Mohamad confirmed the manager’s mobile phone is believed to have been compromised, with the scammer impersonating him through the hacked device.
Why The Message Looked Real
The case is being investigated under Section 420 of the Penal Code for cheating.
Police are urging anyone who suspects they have fallen victim to a scam to call the National Scam Response Centre (NSRC) hotline at 997 immediately to improve the chances of freezing any funds that have been transferred.
While police did not specify how the manager’s phone was compromised, cybersecurity experts say such cases typically involve a WhatsApp account takeover — where a scammer tricks the account holder into surrendering a one-time password (OTP), then logs in on a separate device.
Once inside, the scammer has full access to the victim’s contact list, profile and message history — making impersonation nearly seamless.
Other methods include malware installed via malicious links or SIM-swap fraud, in which a scammer convinces a telco to redirect a phone number to a new SIM card.
In all cases, the recipient sees a real name, real number and real profile photo — with no visible sign anything is wrong.
READ MORE: This “Work From Home” Job Offer Left Malaysians Thousands In Debt
Share your thoughts with us via TRP’s Facebook, Twitter, Instagram, or Threads.
