The message is brief and familiar: “Hi boss, old number kena ban. Save this new WhatsApp for deposit.” The profile photo and display name look exactly like your usual agent. The sender might even know your preferred game, whether it's Mega888, Pussy888, or just casual slots. But honestly, in Malaysia's fast-moving gaming scene, none of that confirms that the number actually belongs to the same person.
Number changes happen for innocent reasons. They are also useful to impersonators because the explanation asks you to ignore the strongest warning—the number is unfamiliar. The safe check begins somewhere other than the new chat.
Use the old-number test first
If you still have the previous conversation, send a simple question there. Do not reveal the new number or ask a question whose answer appears in your chat history (scammers might have cloned the chat). If the old channel replies, ask it to confirm the change. If it no longer works—perhaps the account was genuinely banned by WhatsApp—that still isn't proof the new number is legit. You must move to a public source to verify.
Start from the public website, not the new chat link
Find the organisation’s website independently. The domain should provide a contact route, privacy notice and terms that identify the same service named in the chat. Look for a phone number published on the site. If the WhatsApp number is different, ask the published channel to confirm it.
A screenshot saying “new official number” is weak evidence because the person asking you to trust it also created or forwarded it. A notice on the established domain creates a public record that can be checked later.
Ask three plain questions
- What company or service are you representing? The answer should be specific and consistent with the website.
- Why is this payment required? You should receive a written explanation, not only a countdown or promotion slogan.
- What name should appear before I confirm the transfer? An unexplained mismatch is a reason to stop.
Notice what happens when you ask. A credible support person can answer routine verification questions without becoming hostile. Pressure, insults or repeated “last chance” messages are not verification.
Check the number and payment details separately
Search the phone number and account details for scam reports. PDRM’s Semak Mule service is one official place Malaysians can use to check phone numbers and bank accounts associated with police reports. A clean result is not a guarantee; it only means the details were not returned in that check at that time.
Save the website URL, chat number, payment instructions and account name before transferring. If the agent changes one detail midway through the conversation, ask why and verify again through the public contact route.
Information no agent needs from you
- Your banking password or e-wallet PIN
- An OTP or TAC sent to approve a transaction
- Remote-control access to your phone
- A screen recording that exposes account balances or security codes
- Permission to read your SMS, notifications or Accessibility screen
If “support” sends an Android file and asks for these permissions, pause the payment and read our guide to gaming APK files sent through WhatsApp.
Personal bank account? Treat it as a separate decision
A payment request may show an individual’s name rather than the service name. Do not let the agent wave away that mismatch as “normal” without a documented explanation. Our guide for when the gaming deposit recipient name is different covers the checks and records to keep.
If money has already been sent
Contact your bank through its official number immediately if you suspect deception. PDRM states that Malaysia’s National Scam Response Centre can be reached at 997 around the clock for fast action on financial scams. Keep the transfer receipt and conversation intact rather than deleting the chat. See the current PDRM NSRC notice.
