Guest sent a fake payment receipt? Do not release a door code or key on the strength of a picture. Open your own bank app and confirm the money has actually arrived. If it has not, send the guest a payment link. At Antlerzone the door code goes out only after payment is confirmed, never after a screenshot.
This article is for unit owners who want to know how receipt scams work and how a management company should stop them. It describes a type of incident common across the rental business, not the story of one of our guests. We do not label any group of people: a scammer can be anyone, and you spot one by behaviour, not by looks or names.
Do fake receipt scams really happen in Malaysia?
Yes, and not only in shops. On 19 May 2026, MustShareNews (citing Sin Chew Daily) reported a man in Melaka who was renting out a room for a landlord. The tenant sent a screenshot of a RM1,000 bank transfer for a month's rent and deposit. When checked, there was no record of the money arriving. The couple allegedly used the excuse of an IBG transfer that "hasn't cleared yet", and were linked to at least 10 other businesses. Police investigated under Section 420 of the Penal Code (cheating).
Other reports show the same pattern: a trader in Port Dickson reportedly lost RM780 after being shown a "successful" transaction receipt (The Vibes), and a cake shop owner reportedly lost more than RM19,000 to three customers who forged receipts (WorldOfBuzz). The holiday rental guide Holidu names a scam it calls the "regretful guest": send a fake payment, then invent a reason to ask for a "refund".
Homestays are easy targets for three reasons: direct bookings over WhatsApp, guests who want to check in tonight, and staff who want to be quick. Time pressure is the scammer's main tool.
What are the common versions of the payment scam?
| Version | What the guest says | What is really happening |
|---|---|---|
| Edited screenshot | "Already paid, here is the receipt" | The image is made or altered; no money was sent |
| The IBG excuse | "I used IBG, it'll arrive tomorrow" | Wants to get in before anyone can check |
| Overpayment | "I paid RM1,500 by mistake, please return RM1,000" | The first payment is fake or will be reversed; what you return is your own money |
| Paying off the platform | "Cancel on Airbnb, I'll transfer direct, it's cheaper" | No platform protection, and the receipt can still be fake |
| Someone else's name | "My friend paid for me" | Sometimes a mule account or stolen money |
| Refund to a new account | "Cancelled, please refund to this other account" | Your money goes out to the scammer |
One technical fact matters here: DuitNow is an instant transfer, while IBG is processed in batches by each bank's cut-off times (AmBank, WorldFirst). So "my IBG hasn't arrived" can genuinely happen to an honest guest. The difference is that an honest guest does not mind waiting, or paying again through a proper link.
How are our bookings paid?
This is why most of the scams above do not work on our system:
- Airbnb, Booking.com and Agoda bookings are paid inside the platform. Airbnb itself says payments must happen on the platform, and guests who pay outside it lose AirCover. We do not accept "cancel and transfer direct" offers.
- Direct bookings on our website are paid on a payment page (card, FPX or e-wallet) through a single payment gateway. For website bookings we do not take manual bank transfers, so there is no screenshot to judge.
- Deposits or cash/transfer payments that staff record by hand require choosing which bank account the money went into. In other words, staff should open that account and see the money, not copy a figure from a picture.
That does not make fraud impossible. It means the easiest door, "trust the picture", is closed for most bookings.
What do we do when a receipt looks suspicious?
- No door code, no key. Until the money is confirmed, the guest does not get in. This is not up for negotiation, even if the guest is angry or says they are already in the lobby.
- Check our own bank account. Not a notification the guest forwards, not an email "from the bank". Open the banking app and find the transaction.
- If it hasn't arrived, send a payment link. An honest guest caught by a slow IBG can pay by card or FPX in minutes. If the first transfer does arrive later, it is returned to the same account.
- Never return an "overpayment" before the real money lands. If there is an overpayment, we wait until it has clearly arrived, and refund only to the original account, never to a new one the guest supplies.
- Check the phone number and account. The Royal Malaysia Police run a lookup for phone numbers and bank accounts at semakmule.rmp.gov.my. It is not complete, but an account already reported is a clear warning.
- Keep the evidence and report. Keep the screenshot, phone number and account details given. If money has already gone out, call the National Scam Response Centre on 997 as quickly as possible, then make a police report.
What if the guest is already inside the unit?
This is the hardest case, and it usually happens because someone skipped step 1. In the Melaka case above, the landlord gave three options: pay in cash, leave immediately, or the police. The tenants left the next day.
Our approach: we contact the guest, send a payment link, and give a clear deadline. If it is not paid, the stay ends and the guest is asked to leave. If the guest refuses, we call the police and building management. We do not take matters into our own hands with force or by removing the guest's belongings, because that can become a different legal problem.
Who carries the loss if one slips through?
The honest answer: it depends on why it slipped through.
| Situation | Who should carry it |
|---|---|
| Platform booking, paid inside the platform | The platform that collected the money; the owner follows the platform's payout rules |
| Website booking through the payment gateway | The money is confirmed by the system; the main risk is a card dispute (chargeback), under the gateway's rules |
| Staff released the code based on a picture | A management process failure, not the owner's |
| The owner took a direct booking and released the code | The owner |
The part that is less comfortable for us: we cannot promise that no staff member will ever make a mistake. We are not putting a fixed answer in this article on who pays when staff get it wrong, because that depends on your management agreement. Ask every company in writing, including us: "If your staff hand over the key before the money arrives, who carries the loss?"
There is another cost to admit: the "money first, code later" rule sometimes loses us a last-minute booking from an honest guest who will not wait. We think that is a fair price, but it is still a cost to the owner. Payment gateways also charge a fee, like any card payment.
Is sending a fake receipt a crime?
In the Melaka case, police investigated under Section 420 of the Penal Code (cheating). We are not lawyers and every case is different, so if you lose money, make a police report and get legal advice. A police report also helps when you make a claim with the bank or the platform.
What can owners do themselves?
- Do not give guests your personal account number for "quick bookings". Use a payment link.
- Do not keep the same door code for every guest. A new code for each booking makes a leaked code useless.
- If you self-manage, remember that scammers also target guests with fake homestay listings. We wrote a guide for guests at homestay scam Malaysia: how to check a listing before you pay a deposit.
- If a guest tries to get a "refund" by threatening a bad review, read guest threatens a bad review unless refunded and guest demands a full refund.
The other layers of protection (deposit, guest score, eKYC) are covered in problem guests: deposit, guest score and eKYC.
Summary
A receipt is a picture. Money in the account is proof. We manage more than 100 units in Johor Bahru and Desaru, and the rule is the same for each one: no door code before payment is confirmed, no "overpayment refund" before the real money arrives, and refunds only to the original account.
If you own a unit and want to know how we control payments, deposits and guests for it, contact us through the owner enquiry form.