Malaysians with Cyber Awareness Still Fall Victim to Scams

Businesses across Malaysia are grappling with a paradox: employees say they are confident about online safety, yet fraud reports are soaring. Between January and June 2026, CyberSecurity Malaysia logged 4,143 fraud incidents to the national Computer Emergency Response Team (MyCert). The surge is a wake‑up call for any organisation that assumes awareness alone prevents loss.

What the numbers reveal

• Phishing dominates, 3,885 of the reported cases were phishing attacks, making it the single most common fraud type.
• Who is reporting?, The bulk of reports came from individuals aged 25‑40, a group that largely comprises working professionals.
• Survey contrast, bolttech’s Asia‑Pacific Cyber Safety Landscape 2026 survey of 350 Malaysian consumers found that 88 % rate their online safety habits as good, but only 49 % say they consistently follow strong cyber hygiene.

These figures show a gap between perceived and actual security behaviour.

Where the gaps lie

Password practices

Almost 70 % of respondents admit to reusing passwords across multiple accounts. Reuse means that a breach on one service can unlock many others, amplifying the impact of a single credential leak.

Two‑factor authentication (2FA)

Two‑factor authentication adds a second step, typically a code sent to a phone, to verify a user’s identity. The survey indicates that a majority of Malaysians do not enable 2FA, leaving accounts vulnerable to credential‑stuffing attacks.

Deepfake impersonation

Scammers are now employing AI‑generated deepfake images, voice, and other synthetic content to make impersonation more convincing. This technology makes it harder to spot fraudulent requests that appear to come from trusted colleagues or business partners.

Photo by Andrea Piacquadio on Pexels

Real‑world financial impact

Love and parcel scams remain lucrative. Victims can lose up to RM100,000 in a single incident, underscoring that even highly‑educated users can fall prey to social engineering when emotions are involved.

Practical steps for organisations

1. Enforce unique passwords, Deploy a password‑manager policy that requires distinct, complex passwords for every account.
2. Mandate 2FA, Make two‑factor authentication compulsory for all corporate logins, especially for privileged accounts.
3. Educate on deepfakes, Run short workshops that demonstrate how AI‑generated media can be misused, and teach staff to verify requests through a separate channel.
4. Phishing simulation, Conduct regular, realistic phishing tests and provide immediate feedback to improve detection skills.
5. Incident reporting flow, Ensure every employee knows how to report suspicious emails to the security team and that reports are acted on promptly.
6. Patch management, Keep operating systems and applications up to date to close known vulnerabilities that attackers often exploit after a successful phishing breach.

Bottom line for business leaders

The data tells a clear story: self‑assessment of cyber safety is not a reliable indicator of actual risk. Organisations should treat the gap between perceived hygiene and reported incidents as a strategic vulnerability. By tightening password policies, rolling out 2FA, and raising awareness of AI‑driven impersonation, you can turn awareness into real protection.

Terms used in this article

• Phishing, A fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communication.
• Two‑factor authentication (2FA), A security process that requires two separate forms of identification before granting access.
• Deepfake, Synthetic media created using artificial intelligence that mimics real images, video or audio.
• Password reuse, Using the same password for multiple online accounts.
• Cyber hygiene, Routine practices that maintain the security of devices and data.

Photo by cottonbro studio on Pexels

Key statistics at a glance

These numbers should guide risk assessments and budgeting for security initiatives.