Two very different situations — know which one you're in
"Mule account" covers two situations that feel similar but need different responses:
- You lent, sold, or were paid to let someone use your account. Money that turned out to be scam proceeds moved through it. This can expose you to a criminal investigation — even if you genuinely didn't know the money was illicit.
- Your account was used without your knowledge or consent. Someone got in through phishing, a fake APK, or a leaked TAC/OTP, and moved money through your account without you agreeing to any of it. You are the victim here.
Both truths hold at once: being investigated is serious and should not be minimised, and being investigated is not the same as being found guilty. Read on for the one that matches your situation — and act on both fronts if elements of each apply to you.
If you lent, sold, or were paid to use your account
This usually starts with an offer: a stranger, or a "part-time job" pitch (see our job scam guide), asks to use your bank account or ATM card to "receive payments," sometimes for a fee. What actually moves through the account can be proceeds of a scam played on someone else entirely.
Once that account is flagged, PDRM's Commercial Crime Investigation Department can investigate the account holder as a possible mule — regardless of whether you knew where the money came from. Not knowing is relevant to your defence; it does not mean there is no investigation to answer. In Malaysia, this kind of exposure typically sits under money-laundering-related law (the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001) as well as ordinary police investigation of the account and its transactions.
Being investigated is not a conviction. But do not treat it as a formality either — accounts can be frozen, and enquiries can take time. Take it seriously from the first contact.
If your account was used without your knowledge or consent
If you never agreed to any of this — for example, someone got your TAC/OTP (see I gave my TAC/OTP to someone) or you installed a malicious APK that gave someone remote access (see I installed an APK from WhatsApp) — you are the victim of unauthorised access, not a participant. Your priority is to stop the access, secure the account, and get your own report on record.
Gather your evidence before you talk to anyone
Whichever situation applies, collect this first:
- Every chat/message thread with whoever offered you the "job" or asked to use your account, including how you were approached
- Screenshots of the job or payment offer, and any payment you actually received
- Bank statements showing the transactions in question
- If your account was compromised: a timeline of when the TAC/OTP was shared or the APK was installed, and any device/app evidence from that period
If you're being investigated as a suspect, get a lawyer before you say anything
This applies whether or not you believe you did anything wrong. Anything you say to the police as a suspect can be used in the investigation, and a lawyer can advise you on how to explain what happened — including that you didn't know, if that's the truth — in a way that protects you. Getting legal advice early is standard practice in any criminal investigation; it is not an admission of guilt.
If your account was used without consent, file your own police report
This is separate from, and does not depend on, whether anyone treats you as a suspect. As the victim of unauthorised access:
- Contact your bank's fraud line and ask about freezing the account and reviewing the unauthorised transactions
- Lodge a police report describing exactly how the compromise happened (phishing message, APK, OTP shared under pretext, etc.)
- If money also moved out of accounts you hold as a result, the same urgency applies as any scam loss — see the first 24 hours guide
Where Semak Mule fits in
Semak Mule is the same PDRM portal covered in how to check a scammer's number — it's how other people check an account or number before paying. If your account has been used to move scam money, it may already show a report against it. If you know your own account was compromised, you can report it there yourself, which helps flag it before it's used against someone else.
FAQ
Does being investigated mean I'll be charged or convicted?
No. An investigation is a fact-finding process, not a finding of guilt. But it is a serious process — your accounts may be restricted while it runs, and it can take time. Treat it with a lawyer's help, not with panic or denial.
I was paid a fee for letting someone use my account — does that change things?
It can. Receiving payment specifically for use of your account is generally treated as a stronger indicator that you knew something was being obtained through the transaction, compared to being purely deceived with no payment involved. Either way, stop immediately, keep every message and receipt, and get a lawyer before you say anything to police.
Can I be both a suspect and a victim at the same time?
It's possible — for example, if you agreed to a narrow use of your account and it was then exploited further than you agreed to. The specific facts and evidence matter a great deal here, which is exactly why gathering everything early and getting legal advice matters. If part of what happened was genuinely without your consent, file that portion as a victim report separately.