Malaysians who fall victim to cybercriminals based outside the country may still have legal options under Malaysia's new cybercrime legislation. Under the Cyber Crime Act 2026, authorities can pursue cases involving foreign offenders when their activities affect Malaysian computer systems, infrastructure or Malaysian citizens. This means cybercriminals cannot necessarily avoid Malaysian law simply by operating from another country.
Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi explained that Malaysia's jurisdiction can extend beyond its physical borders when the necessary conditions are met. The government can also use existing international cooperation mechanisms to investigate overseas offenders, pursue prosecution and potentially seek their extradition to Malaysia.
Cybercrime Does Not Stop At National Borders
Modern cybercrime is inherently international. A scammer can operate from one country, host infrastructure in another and target victims thousands of kilometres away without ever physically entering the country where the damage occurs. Traditional legal frameworks built around geographic borders therefore struggle when dealing with online attacks.
Malaysia's updated cybercrime legislation attempts to address this problem by focusing on the effect of the offence rather than simply where the criminal was physically located. If the attack affects Malaysia or Malaysian citizens, the offender may still fall within Malaysian jurisdiction.
Clause 2 Introduces Extra-Territorial Jurisdiction
The key provision is Clause 2 of the Cyber Crime Bill 2026, which deals with extra-territorial jurisdiction. This clause allows Malaysian authorities to take action against cybercriminals based overseas when their activities have a direct connection to Malaysia.
That connection could include attacks against Malaysian systems, critical infrastructure or individuals residing in the country. The principle essentially recognises that a digital offence can have serious consequences inside Malaysia even when every keystroke used to launch the attack originated somewhere else.
Foreign Cybercriminals Could Potentially Be Prosecuted In Malaysia
When the legal requirements are satisfied, Malaysian authorities may investigate foreign-based cybercriminals and attempt to prosecute them under Malaysian law. The fact that an offender resides overseas does not automatically place them beyond the reach of the legislation.
Actual prosecution will naturally depend on several factors, including whether investigators can identify the offender, gather sufficient evidence and obtain cooperation from the country where the suspect is located. Cyber investigations can become complicated when several jurisdictions are involved, but the new law provides Malaysia with a stronger legal basis to pursue these cases.
Extradition Could Be Used When Requirements Are Met
Zahid explained that the government can also rely on international cooperation mechanisms when dealing with offenders located abroad. Depending on the circumstances and the legal relationship between the countries involved, authorities may pursue extradition so that suspects can be brought to Malaysia to face proceedings.
Extradition is not automatic simply because Malaysia requests it. The case would need to satisfy the relevant legal requirements and agreements between the countries involved. Nevertheless, having extra-territorial provisions gives Malaysian authorities a clearer foundation for making those requests.
International Cooperation Is Essential For Cybercrime Investigations
Even with strong domestic legislation, Malaysia cannot investigate international cybercrime entirely on its own. Evidence may be stored on servers located overseas, payment accounts may belong to foreign institutions and communication records may sit with service providers operating under another country's laws.
International cooperation therefore becomes essential. Malaysian law-enforcement agencies may need assistance from foreign police, regulators, telecommunications providers and technology companies to obtain information and locate suspects. The new legislation provides a stronger domestic framework from which those international requests can be made.
The Cyber Crime Bill 2026 Replaces The Computer Crimes Act 1997
The Cyber Crime Bill 2026 was passed on 1 July 2026, replacing Malaysia's much older Computer Crimes Act 1997. The previous legislation was created during a very different period of technology, long before modern smartphones, cloud infrastructure, generative AI and today's highly organised cybercrime industry existed.
Malaysia's new law is intended to provide authorities with stronger tools for dealing with modern digital threats. The change reflects how dramatically cybercrime has evolved over almost three decades and how much more interconnected technology has become.
The 1997 Law Was Created For A Different Internet Era
When the Computer Crimes Act was introduced in 1997, cyber threats looked very different. Online banking was still developing, smartphones did not exist and artificial intelligence was nowhere near capable of generating realistic voices, images or videos.
Today, criminals can automate scams, impersonate individuals using deepfakes, compromise cloud environments and steal identities entirely online. Updating the law therefore became necessary because many modern attack methods were never anticipated when the previous legislation was written.
AI-Driven Scams Are Among The Modern Threats Covered
One of the areas the new legislation is designed to address involves scams assisted by artificial intelligence. Generative AI can now create convincing emails, synthetic voices and realistic images that make social-engineering attacks significantly harder for ordinary users to identify.
Criminals can potentially impersonate family members, company executives or government officials with far greater realism than was previously possible. These capabilities make modern fraud operations faster, cheaper and more scalable, increasing the need for legislation that recognises newer forms of digital deception.
Deepfakes Present Another Growing Challenge
Deepfake technology creates another serious concern because it allows criminals to produce synthetic audio and video that appears to show real people saying or doing things they never actually did. These techniques can be used for fraud, extortion or impersonation.
A victim may receive what appears to be a genuine video call or voice message from a trusted person asking for money or sensitive information. As the technology improves, distinguishing genuine communication from AI-generated material becomes increasingly difficult.
Identity Theft Has Become More Sophisticated
Modern identity theft also goes far beyond stealing someone's username and password. Criminals may combine information from data breaches, social media accounts and leaked documents to build detailed profiles of victims.
Those identities can then be used to open accounts, impersonate victims or conduct social-engineering attacks against their contacts. Stronger cybercrime legislation gives investigators additional tools to pursue the individuals and syndicates operating these schemes.
Critical Infrastructure Attacks Are Also Covered
The legislation also addresses threats against critical infrastructure, which can have consequences far beyond stolen information. Cyberattacks targeting energy, transportation, telecommunications or financial systems can disrupt essential services relied upon by millions of people.
As more infrastructure becomes digitally connected, protecting these systems increasingly becomes part of national security. A cyberattack against critical infrastructure can potentially create physical and economic consequences even when the attacker never enters Malaysia.
Clause 23 Addresses Modern Cyber Threats
Many of the newer cybercrime categories are addressed under Clause 23 of the legislation. The provision is intended to ensure that authorities have a legal framework capable of responding to threats that did not exist or were far less sophisticated when the previous law was drafted.
This allows the legislation to address not only conventional computer intrusion but also the wider ecosystem of digital fraud, identity abuse and attacks against essential systems. Modern cybercrime frequently combines several techniques, making broader legal coverage increasingly important.
Malaysia Can Pursue Cases Beyond Its Physical Borders
Extra-territorial jurisdiction means Malaysian law can apply in certain circumstances even when the offender is physically located elsewhere. The important factor becomes the connection between the crime and Malaysia.
If a foreign attacker compromises a Malaysian system or deliberately targets Malaysian citizens, authorities may still have jurisdiction to investigate the offence. This prevents geography from automatically becoming a shield for criminals whose activities are entirely digital.
The Principle Is Similar To Other Cross-Border Legal Frameworks
Many countries already apply extra-territorial jurisdiction in cases where overseas activity produces direct consequences within their territory. Cybercrime makes this particularly important because the attacker and victim may never be located in the same country.
The concept is similar to other legal situations where involvement of certain financial systems, infrastructure or national interests can bring an offence under another country's jurisdiction. Digital offences increasingly require the same kind of cross-border legal thinking.
Cybercrime Syndicates Frequently Operate Internationally
Large online scam operations often involve teams working across several countries rather than individual criminals operating alone. Infrastructure may be hosted in one jurisdiction while payment accounts, telecommunications services and victims exist elsewhere.
This structure allows criminals to complicate investigations by forcing authorities to coordinate across several legal systems. Extra-territorial provisions give Malaysia a stronger starting position when pursuing syndicates that deliberately target Malaysians from overseas.
Investigative Powers Are Also Expanded
The Cyber Crime Bill 2026 does more than extend Malaysia's jurisdiction. It also provides investigators with additional powers under Clauses 38 through 41, giving authorities mechanisms to preserve and obtain information needed during cyber investigations.
These provisions address several areas particularly important in digital investigations, where evidence can disappear quickly if data is deleted or systems are altered. Investigators therefore need legal mechanisms that allow information to be secured before it vanishes.
Data Preservation Can Be Critical
Cybercrime investigations often depend on digital evidence such as server logs, account information, IP addresses and communication records. Some service providers retain this information only temporarily, meaning investigators may lose important evidence if they cannot act quickly.
Data preservation powers allow authorities to require that relevant information is retained while the investigation continues. This does not automatically mean investigators receive unrestricted access to everything, but it prevents potentially important evidence from being deleted before legal processes can be completed.
Disclosure Powers Can Help Investigators Build A Case
The legislation also provides mechanisms for obtaining relevant information from organisations holding data connected to an investigation. Service providers may possess records capable of linking an online account to a particular device, address or user.
Cybercriminals frequently attempt to hide their identities behind anonymous accounts and online services. Investigators therefore need access to technical records that can help reconstruct how an attack occurred and who may have been responsible.
Traffic Data Can Reveal How An Attack Happened
Traffic data provides another important source of evidence. Even when investigators cannot directly see the content of communications, metadata can help establish connections between systems and accounts.
This information can reveal when a device communicated with a particular server, how frequently connections occurred or which infrastructure was involved in an attack. Combined with other evidence, traffic records can help investigators understand the structure of a cybercrime operation.
Communication Interception Is Also Covered
The legislation provides powers relating to the interception of communications, subject to prescribed safeguards. Interception can be particularly important during investigations into organised cybercrime groups that continue operating while authorities are building a case.
Because interception is intrusive, safeguards are necessary to ensure such powers are used lawfully and proportionately. Strong investigative capabilities need to be balanced against privacy and legal protections.
Safeguards Remain Important
Expanding cybercrime powers naturally raises questions about privacy and government oversight. Powers allowing investigators to obtain data or intercept communications can be extremely useful against criminals but also require appropriate checks to prevent misuse.
The effectiveness of the legislation will therefore depend not only on what powers exist but also on how responsibly they are applied. Clear legal procedures and oversight mechanisms are essential when investigations involve sensitive personal information.
Ordinary Malaysians Gain A Stronger Legal Position
For victims, the most significant change is knowing that an overseas attacker does not automatically fall outside Malaysian law. Someone targeted by a foreign scammer or hacker may still have a case that authorities can pursue.
This is particularly important because many Malaysians encounter cybercrime involving foreign phone numbers, overseas payment accounts or online services hosted outside the country. Under the new framework, the location of the attacker does not by itself end the investigation.
Taking Legal Action Still Requires Evidence
Extra-territorial jurisdiction does not mean every victim will automatically be able to bring a foreign cybercriminal to court. Investigators still need evidence identifying the offender and connecting them to the alleged offence.
Cybercriminals frequently hide behind VPNs, compromised devices and false identities, making attribution difficult. The new law provides legal authority, but technical investigation remains necessary before authorities can successfully pursue a suspect.
Foreign Cooperation Can Determine Whether A Case Proceeds
Even when Malaysian investigators identify an overseas suspect, authorities may need cooperation from that country before taking further action. Foreign law-enforcement agencies may need to execute warrants, obtain records or arrest suspects on Malaysia's behalf.
The success of these cases will therefore depend partly on Malaysia's international relationships and existing mutual legal assistance arrangements. Strong international partnerships are becoming increasingly important as cybercrime grows more transnational.
Extradition Is Likely To Be Case-Specific
Extradition generally requires several legal conditions to be satisfied. The conduct may need to constitute an offence in both countries, and the case must meet requirements defined by treaties or domestic law.
This means extradition will probably be used selectively for more serious cases rather than every online scam complaint. Nevertheless, the possibility sends a clear message that foreign location does not necessarily guarantee immunity from Malaysian prosecution.
Cybercrime Victims Should Still Report Incidents Quickly
The expanded law makes timely reporting more important because digital evidence can disappear rapidly. Victims should preserve suspicious messages, transaction records, email headers, screenshots and any other information connected to the incident.
The sooner authorities receive this information, the greater the chance they have of preserving additional records before criminals delete accounts or move infrastructure. Reporting quickly can also help investigators identify connections between several victims targeted by the same syndicate.
Do Not Delete Evidence Immediately
Victims understandably want to remove malicious messages or suspicious applications immediately, but preserving evidence can be important before everything is deleted. Screenshots, URLs, phone numbers and transaction information may help investigators reconstruct what happened.
Where malware or compromised systems are involved, organisations should consider preserving logs and forensic evidence before rebuilding affected machines. Incident response needs to balance stopping the attack with retaining enough information to investigate it properly.
Businesses Also Benefit From The New Framework
The legislation is relevant not only to individual Malaysians but also to companies targeted by overseas attackers. Malaysian businesses increasingly depend on cloud infrastructure, online payment services and international suppliers, making cross-border cyber incidents common.
An attacker based overseas who compromises a Malaysian company could potentially fall within the same extra-territorial jurisdiction. This gives businesses a stronger legal foundation when cooperating with authorities after an international cyber incident.
Attacks On Malaysian Infrastructure Could Trigger Jurisdiction
Foreign attackers targeting Malaysian servers, networks or critical infrastructure may be investigated even when no Malaysian citizen is specifically singled out. The important factor is that the cyber activity affects Malaysian systems.
This is particularly relevant to attacks against government agencies, telecommunications networks and other critical sectors. Cybersecurity incidents involving national infrastructure can have consequences affecting large parts of the population.
The Law Reflects How Cybercrime Has Changed
The replacement of the Computer Crimes Act 1997 illustrates just how much cybersecurity has evolved. Older legislation focused heavily on unauthorised computer access at a time when cybercrime was much less organised and technology was less interconnected.
Today, criminal groups can operate international scam centres, automate phishing campaigns and use cryptocurrency or digital payment systems to move stolen money quickly. Laws need to account for this broader ecosystem rather than focusing only on the initial computer intrusion.
AI Makes Cross-Border Crime Even Easier
Artificial intelligence can make international cybercrime more scalable by reducing language barriers and automating convincing communications. Criminals can generate messages in Bahasa Malaysia or English that appear natural even when the sender has no knowledge of either language.
Voice cloning and deepfake technology can also make impersonation easier across borders. These capabilities strengthen the case for legislation that allows Malaysian authorities to pursue offenders regardless of where they operate physically.
Legal Jurisdiction Is Only One Part Of The Solution
Strong cybercrime laws are useful, but they cannot eliminate cybercrime by themselves. Malaysia still needs capable investigators, digital forensic expertise and effective cooperation between law-enforcement agencies, banks, telecommunications companies and technology providers.
Prevention remains equally important. Organisations need proper cybersecurity controls while individuals need awareness of phishing, scams and identity theft. Law enforcement becomes the final layer when preventive controls fail.
International Cybercrime Requires International Enforcement
Cybercrime increasingly demonstrates why countries cannot operate in isolation. A scam targeting Malaysians might involve servers in Europe, operators in another Asian country and payments routed through several international financial institutions.
No single agency can obtain all the necessary evidence without outside cooperation. Treaties, mutual legal assistance and direct partnerships between law-enforcement agencies therefore become essential components of modern cybercrime enforcement.
The New Law Could Strengthen Deterrence
Whether the extra-territorial provisions deter cybercriminals remains to be seen, but they reduce the assumption that overseas attackers are automatically beyond Malaysian reach. Criminals operating from foreign countries may still face investigation, asset tracing or extradition if authorities can identify them.
Deterrence becomes stronger when legislation is matched by successful enforcement. High-profile prosecutions involving foreign offenders could demonstrate that the new powers have practical consequences rather than existing only on paper.
Final Thoughts
Malaysia's Cyber Crime Act 2026 significantly expands the country's ability to respond to cybercriminals operating outside its borders. Through the extra-territorial jurisdiction provided under Clause 2, Malaysian authorities can pursue offences committed overseas when those activities directly affect Malaysian systems, infrastructure or citizens.
Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi has confirmed that the government intends to use existing international cooperation mechanisms to investigate foreign offenders, pursue prosecution and seek extradition where the necessary legal requirements are satisfied. The legislation also provides broader investigative powers involving data preservation, disclosure, traffic information and communication interception under prescribed safeguards.
The changes are particularly relevant because modern cybercrime rarely respects national boundaries. AI-powered scams, deepfakes, identity theft and attacks against critical infrastructure can all be launched remotely by individuals who may never physically enter Malaysia.
Replacing the Computer Crimes Act 1997 with legislation designed for today's threat landscape gives Malaysian authorities a stronger legal foundation for dealing with those realities. For Malaysian victims, the important message is that a cybercriminal being overseas no longer necessarily means the case ends at Malaysia's border.
Comments 0