SCAM ALERT: How to spot fake JPJ “blacklist” SMS links and protect your banking data

A text message claiming that your vehicle or driving licence has been blacklisted can cause immediate panic. It may warn that your road tax renewal will be blocked, your licence will be suspended or legal action will begin unless you make a payment immediately.

That sense of urgency is exactly what scammers rely on. Fake JPJ blacklist messages are a form of phishing in which criminals impersonate the Road Transport Department, better known as JPJ, to steal personal information, online banking credentials or money. The message normally contains a link that directs the recipient to a website designed to resemble an official government payment portal.

The safest response is simple. Do not click the link. Do not enter any information. Verify the claim independently through an official JPJ channel.

What is a fake JPJ blacklist SMS?

A fake JPJ blacklist SMS is a fraudulent text message that falsely claims the recipient has unpaid summonses, an enforcement restriction or a vehicle-related blacklist. The message may use JPJ’s name, official-looking language and a payment deadline to appear convincing. Some messages threaten additional fines, court action, licence suspension or vehicle restrictions if the recipient fails to act.

After the victim clicks the link, the fake page may request an identity card number, vehicle registration number, bank name, card information, online banking username, password, Transaction Authorisation Code or One-Time Password. These details can be used to access the victim’s account or approve unauthorised transactions.

How can you spot a fake JPJ SMS link?

The most obvious warning sign is an unexpected message demanding immediate payment through an embedded link. Scammers often create fear by claiming that action must be taken within several hours.

Poor spelling and unusual sentence structure can also indicate fraud. However, correctly written messages should not automatically be trusted. Modern scam messages can closely imitate professional government communication.

Examine the web address without opening it. A fake address may contain misspellings, extra words, unusual symbols or an unfamiliar domain. It may include “JPJ” somewhere in the address while having no official connection to the department.

A secure-looking padlock symbol is not proof that a website belongs to JPJ. It only means that the connection between the browser and website is encrypted. Criminals can also obtain security certificates for fraudulent websites.

Another major warning sign is a request for banking credentials, card verification value, PIN, TAC or OTP. Malaysian banking industry guidance states that banks will not ask customers to disclose their complete card details, online banking password or SMS OTP and TAC numbers through unsolicited calls. 

How should you check whether you are really blacklisted?

Never use the link included in a suspicious message to verify your status. Instead, open the official MyJPJ application directly from your phone or type the JPJ website address into your browser yourself. You may also contact JPJ through contact information published on its official website or visit a JPJ office if clarification is needed.

This independent verification process prevents scammers from controlling the website, telephone number or payment channel you use. Drivers should also remember that an unpaid summons and a blacklist are not necessarily the same thing. 

A blacklist generally refers to an enforcement restriction connected to unresolved cases or specific legal action. A message that uses the word “blacklist” does not prove that such a restriction exists.

What happens after you click a fake link?

Opening a page does not always mean your bank account has been compromised. The level of risk depends on what happened after the page loaded.

The danger increases significantly if you entered personal information, downloaded an application, installed an Android Package Kit file or approved a banking request. Fraudulent applications may attempt to read messages, capture login information or interfere with security notifications.

The Association of Banks in Malaysia advises users not to download installation files from unverified sources and to avoid clicking links received through SMS, WhatsApp, Messenger or similar messaging services. Applications should only be downloaded from genuine application stores. 

Close the page immediately if you opened it accidentally. Do not download anything, allow browser notifications or grant device permissions.

What should you do if banking information was entered?

Contact your bank immediately through its official 24-hour fraud hotline. Do not call a number provided inside the suspicious SMS.

Ask the bank to secure your account, review recent transactions and block affected cards or online banking access where necessary. Customers may also use their bank’s Kill Switch feature, when available, to deactivate online banking access or block cards linked to suspicious activity.

Victims of online financial fraud should contact the National Scam Response Centre at 997 as quickly as possible. The official NSRC guidance states that 997 operates from 8.00am to 8.00pm daily, including public holidays, while bank fraud hotlines operate around the clock. Fast reporting may help limit further losses, although the recovery of stolen money cannot be guaranteed. 

A police report should also be lodged as soon as possible. Keep screenshots of the SMS, website address, transaction records, telephone number and conversations as evidence.

The NSRC, PDRM, Bank Negara Malaysia and financial institutions will not ask victims to provide online banking usernames, passwords, PINs, TACs or OTPs when handling a scam report. 

How can you protect yourself from future JPJ scams?

Treat every unexpected payment message with caution, even when it contains your name, vehicle number or other personal details. Possession of basic information does not prove that the sender represents JPJ.

Access government and banking services through official applications, saved bookmarks or addresses entered manually. Enable transaction alerts and review your bank account regularly so that unauthorised activity can be identified quickly.

You can also check suspicious telephone numbers and bank accounts through PDRM’s Semak Mule platform before making a transfer. The platform is operated by the Commercial Crime Investigation Department for public checks involving reported telephone numbers, bank accounts and company names. 

The most effective habit is to pause before responding. A genuine notice can be verified independently. A scammer normally wants you to act before you have time to think.

FAQ

1. Does JPJ send SMS messages about summonses or vehicle matters?
JPJ may use digital communication for certain services or notices. However, the presence of JPJ’s name in an SMS does not confirm that the message is genuine. Any payment demand or blacklist claim should be verified through the official MyJPJ application, JPJ website or JPJ contact channel.

2. Can scammers make an SMS appear under an official sender name?
Fraudulent messages can imitate trusted organisations or appear in convincing message threads. A familiar sender name should therefore not be treated as complete proof of authenticity.

3. Is my bank account safe if I only clicked the link?
The risk is lower when no information was entered and nothing was downloaded. Close the website, clear the browser session and monitor your accounts. Contact your bank promptly if you entered banking information, installed an application or approved a transaction.

4. Should I call NSRC if I received a suspicious SMS but lost no money?
NSRC 997 primarily handles urgent online financial scam cases involving unauthorised transfers or victims who were deceived into transferring money. Suspicious telephone numbers or accounts can be checked through Semak Mule, while suspicious messages may also be reported to the relevant telecommunications provider or authorities.

5. What information should I never disclose?
Never provide your complete online banking username, password, card PIN, CVV, TAC or OTP in response to an unexpected message, telephone call or website link.

Stay informed with Motorist Malaysia

Scam messages often target drivers by using familiar concerns such as JPJ summonses, road tax renewals and vehicle blacklists. Motorist Malaysia helps motorists stay informed about important driving updates, vehicle ownership matters and common scams affecting Malaysian road users. Visit Motorist Malaysia for trusted automotive information, useful driving tools and convenient services designed to make car ownership simpler and safer.

Read More: Can you legally ride an e-scooter or e-bike on Malaysian roads? Here's what the law says

Download the Motorist App now. Designed by drivers for drivers, this all-in-one app lets you receive the latest traffic updates, gives you access to live traffic cameras, and helps you manage vehicle related matters.