A Malaysian civil servant in Sibu, Sarawak, has lost RM190,000 (about US$40,000) after wiring 25 payments to a Facebook acquaintance who posed as South-Korean superstar Kim Soo-hyun. Police say the fraud unfolded in just ten days and is part of a wave of “K-wave romance” scams now sweeping Malaysia’s social-media feeds.
The chronology comes from a media note issued on 22 April by Sibu district police chief ACP Zulkipli Suhaili and reproduced verbatim by English-language daily The Borneo Post. According to the statement, the victim—a woman in her forties employed by a government agency—accepted a friend request on 1 April from a profile featuring the Korean actor’s photos. By 7 April the fraudster began requesting “urgent financial assistance” to pay alleged customs fees before a promised visit to Malaysia. Between 7 and 16 April the victim transferred RM190,000 across 25 transactions into two domestic bank accounts. When the supposed Kim Soo-hyun demanded more money on 21 April, she filed a report. Police are investigating under Section 420 of the Penal Code, which carries a prison term of up to ten years and possible whipping.
The case was independently confirmed by Utusan Borneo (Malay) and regional broadcaster TVS, whose Malay-language headline—“Dilamun cinta lelaki Korea, wanita rugi RM190,000”—mirrored the police narrative. The consistency across outlets indicates the details come from a single police briefing rather than second-hand social-media chatter.
Fraudsters frequently piggyback on trending celebrities. Kim Soo-hyun—known for the Netflix hit It’s Okay to Not Be Okay—has featured heavily in Southeast-Asian entertainment news since February, when he became embroiled in an unrelated defamation battle at home. Cyber-security analysts say scammers track such spikes in visibility because familiarity disarms potential marks. “Impersonation scams ride the news cycle,” the National Scam Response Centre (NSRC) told The Star earlier this month. “When a face is everywhere online, victims rarely pause to ask whether a friend request is real.”
That sense of urgency is the con’s secret weapon. Police say the Sibu victim received near-daily pleas for help—each framed as time-critical customs or tax issues—until the entire RM190,000 was gone. “Once funds are dispersed through mule accounts, recovery chances fall below twenty per cent after 24 hours,” Bukit Aman Commercial Crime officers warned in the same interview.
Romance fraud is hardly new, but the scale is surging. Malaysia’s NSRC recorded RM1.34 billion in scam losses in 2024, up two-thirds on 2023, according to deputy communications minister Teo Nie Ching (The Star, 29 Jan 2024). Over the past decade, more than 200,000 online scam cases have drained almost RM9 billion from victims—figures the police disclosed in March (The Star, 22 Mar 2025). Bukit Aman’s Commercial Crime Investigation Department (CCID) expects romance and telecommunication scams to dominate 2025 statistics as well.
The Sibu incident also highlights an emerging sub-category: “K-wave romance scams.” NSRC data provided to media in April show 1,288 complaints involving impostors claiming to be Korean actors, singers or esports players in the first quarter alone. While that accounts for under ten percent of all romance scamming by volume, investigators say the losses skew higher because scammers piggyback on luxury-brand imagery and promise extravagant in-person meetings. In one January case a Johor delivery rider wired RM64,000 to a scammer purporting to be a Korean fashion executive (The Star, 6 Jan 2025).
Digital-forensics firm LGMS notes that photos of Kim Soo-hyun circulate widely on Telegram “catfish kits” that bundle stolen images, chat scripts, and tutorial videos for would-be fraudsters. A single kit sells for as little as US$50 on dark-web markets, making it trivial to spin up new fake profiles each time Meta or TikTok purges an account.
Authorities urge rapid reporting. Victims should call the 997 hotline or visit the “SemakMule 2.0” portal, which lists 238,000 suspect bank accounts and 191,000 flagged phone numbers. NSRC says transfers reported within 24 hours stand a one-in-three chance of being frozen before funds exit Malaysia.
Legislators, meanwhile, are grappling with defensive measures. Communications Minister Fahmi Fadzil last month told Parliament the government is studying a Singapore-style real-time debit-freeze mechanism and stiffer penalties for mule-account holders. Bank Negara Malaysia is also piloting artificial-intelligence tools to detect high-velocity transfers from first-time online contacts.
For now, police say public vigilance is the best firewall. Red flags include celebrity friend requests sent from recently created profiles, immediate invitations to private chat apps, and any request for money to process “parcels” or taxes. Authentic entertainment agencies rarely approach fans through personal accounts; most run verified pages with blue-tick badges and disclaimer banners. Gold Medalist—the real Kim Soo-hyun’s agency—watermarks all official publicity photos and has repeatedly warned fans against look-alike accounts.
The Sibu victim’s transfers have been traced to two local mule accounts; investigators are now following the money trail to identify upstream beneficiaries. Even if arrests follow, commercial-crime experts say the likelihood of full restitution remains slim. “The sad reality is that stolen funds usually exit the banking system in the first six to twelve hours,” notes former CCID director Datuk Acryl Sani, now an independent cyber-security adviser. “Once they are converted to crypto or moved offshore, the money is gone.”
Malaysia’s scam epidemic mirrors a global trend, but the K-wave twist underlines how pop-culture fandom can be weaponised. “Scammers exploit the parasocial bond—fans feel they know the star,” says Universiti Malaya social psychologist Dr Lim Sze Wen. “That emotional shortcut overrides the scepticism they would show a stranger.” Until digital platforms hard-gate friend requests or governments mandate real-time account freezes, the burden remains on users to refuse urgent money requests—no matter how handsome the profile photo appears.
Anyone who believes they have been targeted by a similar impostor should call the National Scam Response Centre on 997 within 24 hours, visit SemakMule 2.0 to check bank and phone numbers, and lodge a report at the nearest police station.
