Sextortion on Instagram, Facebook, TikTok or WhatsApp in Malaysia? Your first hour: do not pay, keep evidence, report in the app, StopNCII, and police.
Do not pay. Stop replying but keep the chat, screenshot the profile and every threat, then report and block in the app where the message arrived. Adults with the image on device can open StopNCII.org; make a police report, and call your bank and NSRC on 997 if money already moved.
SummaryThe message arrives on Instagram, in a Facebook chat, through TikTok DMs or on WhatsApp. Someone claims they have an intimate image or recording and threatens to send it to your family, boss or followers unless you pay today.
You do not need the perfect plan before you act. You need a short sequence that keeps you safe, preserves evidence and opens the official routes platforms and Malaysian authorities recognise.
This page is the first-hour version. Our longer sextortion guide for Malaysia covers StopNCII, minors, wellbeing and follow-up reporting in depth.
Last checked: 9 November 2026.
Do not pay. Stop replying but do not delete the chat. Screenshot the profile, usernames, links and every threatening line with the date visible. Report and block inside the app where the threat arrived, using threats or blackmail as the reason where offered. If you are 18 or over and still have the image on your device, open StopNCII.org the same day. Tell someone you trust, make a police report with your folder, and if money already moved call your bank and the National Scam Response Centre on 997 first.
Sextortion means someone is using intimate images, videos or messages to force payment, more images or silence. NCMEC's sextortion page treats it as a form of blackmail, whether the material is real, edited or entirely fake.
Instagram's guidance on blackmail states that threatening to share intimate content without consent breaks its rules and is not the victim's fault. The same principle applies on other apps: the crime is the threat and the pressure, not a choice you may regret. Fear is normal; the order of steps still matters.
| Time | Do this | Why it matters |
|---|---|---|
| Minute 0 to 5 | Stop replying. Do not delete the chat or your account. | The messages are evidence for the app and the police. |
| Minute 5 to 15 | Screenshot profile, links, payment instructions and each threat with date visible. | Profiles change names; dated captures survive edits. |
| Minute 15 to 25 | Report and block in the app where the threat arrived. | Reports are anonymous on Instagram per its reporting help. |
| Minute 25 to 35 | Make your own accounts private and review follower lists. | Reduces who the blackmailer can name in threats. |
| Minute 35 to 50 | Open StopNCII if you are an adult with the image on device. | Only a hash leaves your phone, per StopNCII. |
| Minute 50 to 60 | Tell someone you trust. Start a police report folder. | PDRM lists chat screenshots as usable proof in its FAQ. |
Report from the profile or chat, not from a generic web form unless the help centre directs you there. Wording changes by language and app version.
Call your bank or e-wallet provider at once and ask whether any transfer can be frozen. Then call the National Scam Response Centre on 997. MyGOV's NSRC page says reporting within 24 hours helps authorities try to block accounts and trace funds. Keep every receipt for the police report.
Sextortion is a crime beyond platform policy. Make a police report at the nearest station or through online channels your state offers. Bring printed or saved copies of chats, profile links, payment details and your timeline. You do not need to show intimate images on your phone screen in the waiting area; ask officers privately what format they need.
Accounts may rename, clone your friends list or move to another app. If a new profile repeats the same threat, add it to the same evidence folder rather than starting over. Report each account separately. If images appear on a public feed, follow our guide to intimate image abuse removal in Malaysia for posts that are already live.
In Malaysia, you can also log harm on CyberSecurity Malaysia channels if your workplace policy asks for a national reference, but a police report remains the criminal route. MCMC complaints help when licensed platforms leave clearly harmful content up after you filed in-app reports.
You do not have to sit alone with the threat. Talian Kasih and other Ministry of Health psychosocial lines support adults in crisis; your police report and bank call can happen the same day. If the blackmailer named your employer or school, tell one responsible person there after you have secured evidence, so they do not click unknown links sent in your name.
Most people can complete the steps above without paid help. SocialSafe by AwareXone, the recovery and removal line of AwareXone, may help when threats spread across several apps, when repeat accounts respawn faster than you can document them, or when you need a structured evidence pack for a brand crisis. We use official channels only and never ask for passwords or OTP codes. Read /trust before sending sensitive material.
More free guides on the same kind of problem.
