Scammed by a fake site: your first 24 hours, step by step

Work out what the fake site got

Your first move depends on what you handed over. If several rows apply, money and banking come first.

If the phone itself may be compromised, use another device for the bank call and password changes.

Change the password and sign out everywhere

1. Type the address yourself. Enter slotkaki.shop in the browser and log in from there, not from the link that led you to the fake page.
2. Pick a password you have never used, ideally 12 characters or more, not the old one with a digit added.
3. Change any account that shares that password. Start with your email, since email is how other passwords get reset.
4. End other sessions. If your account shows an option to sign out of all devices, use it. If you cannot see one, ask support to end active sessions and check for logins you do not recognise.
5. Check your profile. Confirm the phone number, email and withdrawal bank account are still yours, and report any change you did not make.

Locked out because someone else changed the password? Stop retrying and contact support. Security locks and how to get them lifted are covered in the guide to suspended or locked accounts.

Ring your bank and NSRC 997

NSRC 997 is Malaysia's national line for reporting online financial fraud. It works with banks and the police to try to stop money moving further down the chain.

1. Call your bank's fraud line. The number is on the back of your card or in the banking app. Ask them to stop the transaction and, if an OTP was exposed, freeze the account and cards.
2. Call NSRC 997. Have ready your bank name, the receiving account name and number, the amount, date, time and transaction reference.
3. Tell the e-wallet too. For Touch 'n Go eWallet, GrabPay or Boost, use the in-app help centre.
4. File a police report at your nearest police station. Banks usually ask for a copy before investigating further. Take your identity card and the evidence.
5. Look the account up on Semak Mule (semakmule.rmp.gov.my), the Royal Malaysia Police tool that shows whether a bank account or phone number has been reported. A "no record" result does not prove the account is clean.

SlotKaki cannot refund money paid to a fake site, because it never reached SlotKaki. Only your bank, NSRC and the police can act on the receiving account, and nobody can promise a recovery.

Keep the evidence before you block anyone

Screenshot first; block or delete afterwards. Complete records help the bank and police trace the money.

• The address bar showing the full fake address (a typical pattern: slotkaki-bonus-xx.example). Copy it into a note as text as well.
• The entire chat, including the sender's username or phone number, not just their display name.
• Transfer receipts: reference number, receiving account name and number, amount and time.
• The SMS, email or fake search ad that sent you there.
• The APK file name, if any. Do not open it again.

Be wary of "fund recovery" offers: anyone promising to get your money back for an upfront fee is usually running a second scam. Genuine authorities never ask you to move money into a "safe account".

Report it through official support

Once the bank and NSRC know, tell SlotKaki through official channels only: live chat inside your account, Telegram @Slotkakiofficial or email slotkakiplay@gmail.com. How to confirm you have the real ones is explained in the official support channels guide.

1. Give your username, never your password or an OTP.
2. Say roughly when you used the fake page, and its address.
3. Attach the screenshots you saved.
4. Ask support to review logins and profile changes since that time.

To avoid a repeat, go back over how to spot a fake SlotKaki site.

Frequently asked questions