Pakistan arrests 130 Malaysian Nationals in Rawalpindi's 'Malaysian Police' Call Centre - Full List

Pakistan's National Cyber Crime Investigation Agency (NCCIA) has booked 130 Malaysian nationals over an alleged call centre in Rawalpindi that posed as bank staff and Malaysian police to defraud people in Malaysia. According to the First Information Report (FIR), the operation was allegedly directed from Cambodia by a Malaysian man known only as "Jack".

A visa-status annex prepared for the case, which research team from Ministry of Cyber Affairs has reviewed, shows that 26 of the 124 accused whose entries are visible were still marked as holding valid visas. That runs against earlier media reports that every one of the 130 had overstayed. Ministry of Cyber Affairs is publishing the full list of the accused and their visa records below, without passport numbers.

Key facts

• FIR: No. 182/26, NCCIA Circle Rawalpindi, reported on 13 October 2026 at 21:55.
• Informant: Syed Javed Hussain Shah, Technical Assistant, NCCIA Rawalpindi.
• Charges: Sections 13, 14 and 16 of the Prevention of Electronic Crimes Act (PECA) 2016, as amended in 2025, read with Sections 34, 383, 419, 420 and 109 of the Pakistan Penal Code (common intention, extortion, cheating by personation, cheating and abetment).
• Enquiry: No. 2610/26, which started from a source report.
• Location: KASA Tower, Bahria Town Phase VIII, Rawalpindi.
• Accused: 130 Malaysian nationals named with passport particulars. An alleged controller abroad, four Pakistani facilitators known only by assumed names and a Chinese national are also mentioned but not identified.
• Officers: the FIR was registered by Sub-Inspector Amjad Bilal. Sub-Inspector Liaqat Ali is investigating.

According to the FIR, NCCIA officers obtained search and seizure warrants from a court in Rawalpindi once enquiry 2610/26 was complete. They then raided the premises at KASA Tower. Officers told the people inside why they were there and examined the digital devices and the "operational setup" on the spot.

Organized cyber-enabled financial fraud targeting Malaysian nationals

The FIR says this preliminary technical analysis showed the premises were "allegedly being used for organized cyber-enabled financial fraud targeting Malaysian nationals". The people found there were identified with their passport details. An Istighasa (complaint report) was then sent to the police station, and the case was registered against all 130.

The FIR states that the roles of the alleged principal controller, local supervisors, financial facilitators, crypto handlers and others "shall be ascertained during the course of investigation". Being named in an FIR is not a finding of guilt. No court has ruled on any of the allegations.

Modus operandi: Law Enforcement Impersonation Scam

The FIR describes how a victim in Malaysia was allegedly taken through the scheme. Steps 1 to 6 are taken from the FIR. Step 7 is based on what the FIR says about the money trail inside Pakistan. This is a classic case of Globally prevalent Law Enforcement Impersonation Scam; also known as fake police authority extortion scam.

Step 1: A call from "the bank"

The FIR says callers at the Rawalpindi premises allegedly contacted victims through VoIP (internet calling) applications while posing as bank customer service staff. Internet calling lets a caller in Pakistan reach a Malaysian phone cheaply. Malaysian police have said phone-scam syndicates also use caller ID spoofing so their calls appear to come from local numbers.

Step 2: The "suspicious transaction" alarm

According to the FIR, victims were told that suspicious transactions had been found in their bank accounts. This created urgency and fear before any money was requested.

Step 3: The hand-off to "Malaysian police"

The FIR says the callers then transferred the victims to people posing as Malaysian police officers. This scripted hand-off from a bank or company "agent" to an "officer" is the pattern Malaysian police describe in what is known locally as the Macau scam.

Step 4: The uniformed video call

Certain male and female members of the group allegedly posed as police officers in uniform, using an office-like video-call setup, according to the FIR. Seeing a uniform and an office backdrop on a video call is meant to convince the victim that a real investigation is under way.

Step 5: The money-laundering threat

According to the FIR, the fake officers threatened victims with money-laundering allegations, criminal cases and legal proceedings to "induce them to transfer money". In similar cases, Malaysian police say victims are usually told to keep the matter secret.

Step 6: Payment through Touch 'n Go eWallet

The FIR says the proceeds were reportedly received through Touch 'n Go eWallet, a widely used Malaysian digital wallet. The money was then converted into cryptocurrency "through different channels". The FIR does not name any wallet account, exchange or token.

Step 7: Crypto to Pakistani rupees in cash

According to the FIR, a Chinese national said to live in Sector D-12, Islamabad, reportedly received cryptocurrency from the operators and paid them the equivalent in Pakistani rupees in cash. This appears to be how the operation was funded locally. The FIR says this person's identity, role and the full money trail have not yet been established.

The alleged chain of command

According to the FIR:

• "Jack", a Malaysian national reportedly operating from Cambodia, was allegedly controlling and directing the network from abroad. He has not been identified further.
• Mohamad Shawalludin was identified as the local supervisor or "boss".
• Hew Wei Lun was identified as the manager responsible for running the call centre.
• Pakistani nationals using the assumed names Sohail, Rich, Martin and B allegedly facilitated the operation.
• An unnamed Chinese national, reportedly living in Sector D-12, Islamabad, allegedly handled the crypto-to-cash exchange.

The Cambodia connection

The FIR's only statement about Cambodia is that "Jack" was reportedly operating from there and allegedly controlling the Rawalpindi operation. The FIR gives no further evidence of a Cambodian link. Ministry of Cyber Affairs has not independently verified Jack's identity or location.

What sets this case apart, if the FIR's allegations hold, is the structure: a call floor of Malaysian nationals in Pakistan, allegedly directed from Cambodia, calling victims in Malaysia in their own language, with cash supplied locally through a crypto exchanger. Investigators have not said whether the Rawalpindi premises was linked to any particular Cambodian compound.

What the visa annex shows

The annex lists 130 entries, numbered as in the original, under the heading of visa status. Ministry of Cyber Affairs' count of the 124 visible entries is below. Rows 38 to 43 were not visible in the copy reviewed.

• Visa type: all 124 visible entries are "Visit" visas.
• Status: 98 are marked "Expired", 24 "Valid" and 2 "Extension/Valid", so 26 are marked as valid in some form. A note on the annex says: "Out of 130 accused, only 24 has valid visa (02 have an extension visa". If the note's 24 includes the two extensions, the annex rows themselves give two more valid entries than the note.
• Overstay at the time of the raid: of the "Expired" entries, 52 have visa end dates before the FIR was registered on 13 October 2026. Those overstays ranged from one day to 59 days. The longest was alleged local supervisor Mohamad Shawalludin, whose visa is recorded as ending on 15 August 2026.
• Status recorded after the raid: another 46 entries marked "Expired" have end dates between 13 and 27 October 2026. This suggests the annex was compiled some days after the raid, by which time those visas had lapsed.
• Arrivals in two waves: 92 of the 124 visible entries arrived on 2, 3 or 4 August 2026 (15, 52 and 25 people), and one more is recorded as "3/8/2029", which is probably 3 August 2026. A second group of 24 arrived on 28 and 29 September 2026. Most of the "Valid" visas belong to this second group and were issued on 29 or 30 September.
• Earlier arrivals: Mohamad Shawalludin arrived on 8 June 2026, Tan Lek Tong on 4 July and alleged call-centre manager Hew Wei Lun on 30 July, ahead of the August wave.
• Anomalies, shown in the table as written: one visa issue date reads "28-09-10" and one arrival date reads "3/8/2029". One entry is marked "Valid" with an end date of 1 October 2026. One is marked "Expired" with an end date of 27 October 2026. Several entries show an arrival date before the visa issue date, and two show an arrival after the visa end date. These may reflect re-issued or extended visas or clerical errors. NCCIA has not explained them.

Full list of the accused

The table below reproduces the NCCIA visa annex. Names and dates are spelled exactly as in the source document, including apparent typos. Passport numbers have been removed. Rows 38 to 43 were not visible in the annex reviewed. Their names are taken from the FIR and their visa details are marked as not shown. All 130 people are accused only. None has been convicted.

Data Insights

1. The accused arrived in two waves - 92 people arrived on 2–4 August, and 51 of them on 3 August alone. A second group of 24 arrived on 28–29 September. The earliest arrival was Mohamad Shawalludin on 8 June; the FIR names him as the alleged local supervisor. Hew Wei Lun, named as the alleged manager, arrived on 30 July, just before the main lot.

2. VISA ran out of Date around FIR

What happens next

The FIR says the roles of the alleged controller, local supervisors, financial facilitators and crypto handlers will be established during the investigation, along with the identities of the Pakistani facilitators and the Chinese national. Pakistan is fast becoming a base for transnational cybercrime. In the past month alone, NCCIA Islamabad says it arrested 671 people, 473 of them foreign nationals, across 16 call centres, seizing about 13,000 devices. Rawalpindi has now added 130 Malaysians allegedly working for a controller in Cambodia. Before them came a Satellite Town call centre that allegedly threatened foreigners over loans, Lahore operations defrauding Americans and Britons, and a Rawalpindi desk running Telegram romance scams against Australians. The pattern is consistent: foreign crews and foreign victims, rented office towers, internet calling, and crypto turned into local cash.