Shopee & Lazada Scams in Malaysia: How to Spot Fake Sellers and Phishing Attacks

Online shopping in Malaysia is booming. Shopee and Lazada together process millions of orders daily, with Malaysians spending billions of ringgit annually on everything from electronics to groceries. But the explosive growth of e-commerce has created fertile ground for scammers.

The Malaysian Cyber Security Agency (MyCERT) documented a sharp rise in e-commerce fraud reports in 2025, with Shopee and Lazada being the most impersonated platforms. Here is what kailangan mong watch out for.

Fake Seller Scams

The most common e-commerce scam in Malaysia involves fraudulent sellers who list products at suspiciously low prices. A brand-name phone for RM200. A designer handbag at 90% off. A gaming laptop for half the market price.

Paano the Scam Works

1. The seller creates a shop with positive reviews (often purchased or generated by bot accounts).
2. They list desirable products at below-market prices to attract buyers.
3. After purchase, they either send a completely different item (a brick instead of a phone), a cheap counterfeit, or nothing at all.
4. The seller then closes the shop and opens a new one under a different name.

Warning Signs

Red Flag	What It Means
Price significantly below market	Too good to be true pricing
New shop with few or identical reviews	Reviews may be fabricated
Seller asks to transact outside the platform	Bypasses buyer protection
No return policy or vague product descriptions	Seller plans to disappear
Stock photos instead of actual product images	Product may not exist

Paano to Protektahan ang Iyongself

• Check seller ratings and review patterns. Real reviews vary in length and detail. Fake ones are often short and posted around the same dates.
• Use Shopee Guarantee / Lazada buyer protection. Never release payment confirmation until you have received and verified the product.
• Be suspicious of requests to communicate via Facebook Messenger. Legitimate sellers handle everything within the platform.

Ang Fake Order Confirmation Scam

You receive an SMS or email that looks like it is from Shopee or Lazada:

"Your order #MY2026031985634 has been shipped. Track here: [suspicious link]"

The problem? You never placed this order. Curiosity gets the better of you, and you click the link. The fake tracking page asks you to log in to "verify your account," and just like that, the scammer has your credentials.

Variations of This Scam

• Refund notifications: "Your order has been cancelled. Claim your RM89.90 refund here."
• Prize winnings: "You've won Shopee's monthly lucky draw! Claim RM500 voucher."
• Account security alerts: "Your Lazada account has been compromised. Reset password now."

Paano to Verify

• Open the Shopee or Lazada app directly — never click links in messages.
• Check your order history within the app.
• Look at the sender's email address or phone number carefully. Official Shopee communications come from @shopee.com.my.

COD (Cash on Delivery) Fraud

COD scams are particularly prevalent in Malaysia. Here are two common variants:

Ang Phantom Order

You receive a parcel via COD that you never ordered. The delivery rider expects payment. In the confusion, many people pay — especially if other household members might have placed the order. The parcel contains worthless items.

What to do: Always confirm with family members before paying for COD parcels you do not recognize. You have the right to refuse any COD delivery.

Ang Switched Product

You order a legitimate product via COD. When it arrives, the parcel feels right, but inside is a completely different (cheaper) item. By the time you open it, the rider is gone.

What to do: Record a video when opening COD parcels. This serves as evidence for dispute claims on Shopee or Lazada.

Phishing via Fake Customer Service

Scammers create fake Shopee and Lazada customer service accounts on Facebook Messenger, Facebook Messenger, and even Facebook. They target people who post complaints publicly about their orders. The "customer service agent" reaches out offering to help resolve the issue.

They then request:

• Your account login credentials "to investigate the problem."
• A screenshot of your banking app "to process the refund."
• A TAC code sent to your phone "for verification purposes."

Real customer service will never ask for your password, banking credentials, or TAC codes. Always contact support through the official app.

Pagprotekta sa Your Shopping Accounts

Security Measure	Shopee	Lazada
Two-factor authentication	Available	Available
Biometric login	Supported	Supported
Login notifications	Enabled by default	Enabled by default
Trusted device management	In settings	In settings

Additional steps:

• Use a unique, strong password for each platform.
• Do not reuse your e-commerce passwords on other sites.
• Review linked payment methods regularly and remove unused ones.
• Log out of devices you no longer use.

Sharing Order Details and Tracking Info nang Ligtas

When coordinating group purchases or sharing order tracking with friends and family, avoid pasting full tracking links or account details into group chats. A compromised group chat can expose this information.

With LOCK.PUB, maaari kang share tracking information, order details, or account references through password-protected links. Set the link to expire after a few days, and only the intended recipient — who knows the password — can access the information.

Ano to Do If You Have Been Scammed

1. Do not confirm receipt of the order on the platform. This is your main leverage for a refund.
2. Open a dispute through the platform's resolution center with photos and videos as evidence.
3. Report the seller on the platform.
4. File a police report -- this is required for bank chargebacks and insurance claims.
5. Report to KPDNHEP (Ministry of Domestic Trade and Consumer Affairs) at 1-800-886-800.
6. Report the scam on CCID Scam Response Center at 03-2610 1559.

Shop Smart, Manatiling Ligtas

E-commerce has made life more convenient for millions of Malaysians, but that convenience requires vigilance. Trust the platform's built-in protections, verify before you click, and never share sensitive information through unprotected channels.

---

Keep your sensitive information protected. Create password-protected links and encrypted memos at LOCK.PUB.