⚠ CYBERSECURITY ALERT · OCTOBER 2026

Fake LHDN Tax Emails in Malaysia:
Two Real Phishing Examples Received by AIG

Ark IT Global received two suspicious tax-related emails on the same day. Discover how scammers impersonate government authorities and learn how to protect your business.

Ark IT Global 26 October 2026 Cybersecurity Awareness 6-Minute Read

CYBERSECURITY AWARENESS

Two Suspicious Tax Emails Received Within One Hour

On 26 October 2026, Ark IT Global received two suspicious emails impersonating Malaysia's tax authorities.

The first message, written in Bahasa Malaysia, claimed outstanding taxes and penalties. The second, written in English, claimed that a tax return review was required.

Both emails attempted to direct recipients towards suspicious links or documents, using government-related wording and the threat of financial penalties.

These examples demonstrate how phishing attempts may vary in language and presentation while relying on similar deception techniques.

Official LHDN Warning: On 22 October 2026, LHDN listed "Notis Tuntutan Cukai dan Penalti" on its official scam-alert page. The second example below is independently suspicious but has not been verified as part of that specific official alert.

REAL PHISHING EXAMPLE 01

Fake Tax Demand & Penalty Notice

An email written in Bahasa Malaysia claimed that the recipient had outstanding tax liabilities and must act within 72 hours.

EXAMPLE 01 · MALAY

Notis Tuntutan Cukai dan Penalti

Received: 26 October 2026 · 10:06 AM

Suspicious Malay-language LHDN tax penalty phishing email

Actual suspicious email screenshot received by Ark IT Global.

Why This Email Is Suspicious

Unofficial Sender Domain

The sender address contains government-related wording, but its actual domain is wxtengyi.com rather than hasil.gov.my.

72-Hour Deadline

The email threatens consequences unless the recipient takes action within 72 hours. Such pressure is commonly used in phishing attacks.

Suspicious Download Button

Recipients are instructed to download alleged tax documents through an unverified link.

REAL PHISHING EXAMPLE 02

Fake Sales Tax Return Review Notice

A second suspicious email arrived approximately one hour later, claiming a tax filing review and requesting recipients to open an attached document.

EXAMPLE 02 · ENGLISH

Notice of Sales Tax Return Review

Received: 26 October 2026 · 11:06 AM

Suspicious English-language tax return review email impersonating LHDN

Second suspicious tax-related email received by Ark IT Global on the same day.

Why This Email Is Suspicious

Unrelated Sender Domain

The sender used IsaacSearle@nengbowj.com, an address unrelated to LHDN's official hasil.gov.my domain.

Desktop Download Request

The email encourages users to access the alleged tax documents using a desktop or laptop. This unusual instruction warrants caution.

Audit & Penalty Pressure

The message refers to tax reviews, a 15-day confirmation deadline and potential penalties to encourage interaction.

PHISHING TECHNIQUES

Different Emails, Similar Warning Signs

Although the messages use different languages and subject lines, both contain suspicious indicators that employees should recognise.

Indicator	Email 01	Email 02
Language	Bahasa Malaysia	English
Claim	Unpaid taxes and penalties	Tax return review
Sender Domain	wxtengyi.com	nengbowj.com
Urgency	72 hours	15 days
Requested Action	Download tax attachment	View alleged tax document
Main Risk	Suspicious link or file	Suspicious link or file

BUSINESS SECURITY CHECKLIST

Six Ways to Protect Your Business

Employees should remain cautious when receiving unexpected tax notices, audit requests or payment instructions.

Verify the Sender

Inspect the actual email address and domain. Do not trust the display name alone.

Avoid Suspicious Links

Do not open unexpected links, attachments or download buttons.

Confirm Through Official Channels

Visit www.hasil.gov.my directly to verify suspicious tax communications.

Report Suspicious Emails

Inform your IT administrator and report suspected phishing attempts.

Strengthen Email Security

Use appropriate email filtering, MFA, endpoint protection and employee security awareness.

Verify Unexpected Payments

Require independent verification before processing unusual tax or financial requests.

OFFICIAL GOVERNMENT GUIDANCE

Verify Suspicious Tax Communications

Official LHDN Security Guidance

LHDN advises taxpayers to remain alert to fraudulent communications impersonating tax authorities.

Recipients should verify unexpected tax demands through official channels, avoid suspicious links and protect confidential or banking information.

Official Website: www.hasil.gov.my
HASiL Contact Centre: 03-8911 1000
Suspicious Email Reports: aduan@hasil.gov.my

Official LHDN Scam Alerts ↗ Online Security Guidance ↗

INCIDENT RESPONSE

What If an Employee Already Clicked?

Immediate reporting and appropriate security measures can help reduce the impact of a suspected phishing incident.

Stop Interacting

Do not continue opening suspicious links, attachments or websites.

Notify Your IT Team

Report what happened and whether credentials or information were entered.

Secure Affected Accounts

If credentials were disclosed, change passwords through legitimate channels, revoke affected sessions and review MFA.

Investigate Devices

If malware is suspected, follow incident-response procedures, including isolation when appropriate.

Review Security Controls

Preserve relevant evidence, report the incident where appropriate and review safeguards to prevent recurrence.

CYBERSECURITY FOR MALAYSIAN BUSINESSES

Cybersecurity Starts With Awareness

Phishing attacks can affect organisations of all sizes, including SMEs, corporations, schools and professional firms.

Employees are often the first line of defence against fraudulent communications. However, awareness should be supported by appropriate technical safeguards.

Ark IT Global helps Malaysian businesses review their IT environments and strengthen cybersecurity through network security solutions, endpoint protection and managed IT services.

ARK IT GLOBAL · CYBERSECURITY

Is Your Business Prepared for the Next Phishing Attempt?

Protecting your organisation requires more than employee awareness. Review your email security, endpoint protection, firewall infrastructure and overall IT security readiness.

Request a Cybersecurity Assessment ↗

REFERENCES

Official Resources & Further Reading

LHDN – Latest Scam Cases ↗

LHDN – Scam Prevention Guidance ↗

LHDN – Online Security Guidance ↗

AIG – Networking & Cybersecurity Solutions ↗

Disclaimer: This article is provided by Ark IT Global Sdn Bhd for cybersecurity awareness and educational purposes only. Ark IT Global is not affiliated with LHDN. The screenshots illustrate suspicious email communications received by AIG. Their inclusion does not establish that any particular link contains malware. For official tax matters, contact LHDN directly.

Fake LHDN Tax Emails in Malaysia: Two Real Phishing Examples Received by AIG

Two Suspicious Tax Emails Received Within One Hour

Fake Tax Demand & Penalty Notice

Notis Tuntutan Cukai dan Penalti

Why This Email Is Suspicious

Fake Sales Tax Return Review Notice

Notice of Sales Tax Return Review

Why This Email Is Suspicious

Different Emails, Similar Warning Signs

Six Ways to Protect Your Business

Verify the Sender

Avoid Suspicious Links

Confirm Through Official Channels

Report Suspicious Emails

Strengthen Email Security

Verify Unexpected Payments

Verify Suspicious Tax Communications

Official LHDN Security Guidance

What If an Employee Already Clicked?

Stop Interacting

Notify Your IT Team

Secure Affected Accounts

Investigate Devices

Review Security Controls

Cybersecurity Starts With Awareness

Is Your Business Prepared for the Next Phishing Attempt?

Official Resources & Further Reading

Fake LHDN Tax Emails in Malaysia:
Two Real Phishing Examples Received by AIG