A genuine SSM (Suruhanjaya Syarikat Malaysia) approval email always comes from the official domain @ssm.com.my, never asks you to transfer money to a third-party account, and any attached document is a Digital Certified True Copy (DCTC) in PDF with a QR code you can check yourself. If an email pressures you to pay urgently, links to a site that isn’t SSM’s own portal, or contains a document without a verifiable QR code, treat it as fake until proven otherwise. This matters because scammers specifically target new and existing Sdn Bhd owners in Malaysia, forging SSM branding to push fake renewal fees, bogus investment schemes, or fraudulent job offers.

🔔 TL;DR

  • Real SSM emails come only from @ssm.com.my and route through official channels like Ezbiz, MyCoID and MyLLP, not random payment links.
  • Every genuine SSM document is a DCTC with a QR code you can verify using the SSM DCTC QR Code Reader app or the Web Checker.
  • Scammers create false urgency by misrepresenting processing times. Real SSM company registration generally takes 1 to 3 working days, and Annual Returns are generally due within 30 days of your incorporation anniversary [Companies Act 2016, Section 68].
  • You can independently confirm any company’s legitimacy using the SSM e-Info portal or an SSM search company name lookup, rather than trusting the email alone.
  • Falsifying or submitting false SSM documents is a serious offence under the Companies Act 2016, carrying penalties well beyond a simple fine.

ABOUT THE AUTHOR

Boss Boleh is an online company secretary and incorporation platform built for first-time entrepreneurs. Beyond company secretarial work, it also offers a one-stop compliance solution for entrepreneurs, including accounting, tax planning and tax filing services. Because our team submits and tracks SSM filings daily, we see firsthand what a genuine SSM communication looks like, and where fake ones go wrong.

📌 Why do scammers target SSM communications specifically?

SSM is the statutory body every Malaysian company must register and file with, so almost every business owner expects to receive emails from it at some point. That expectation is exactly what scammers exploit. A new company owner anticipating an incorporation certificate, or an existing Sdn Bhd expecting an Annual Return reminder, is primed to open an email that looks official and act quickly. Scammers impersonate SSM through phishing emails, WhatsApp messages and fake websites, using forged certificates and registration numbers to push fraudulent investment schemes, fake job offers, or invented renewal fees. The forged documents often copy SSM’s logo and layout closely enough to pass a quick glance, which is why checking the underlying technical details matters more than checking how the email looks.

📌 What does a genuine SSM email or document actually look like?

A real SSM communication has a few fixed characteristics that are hard for scammers to fake convincingly. Knowing these lets you check any email in under a minute.

  • Sender domain: Official SSM emails come from @ssm.com.my. Anything from a free email service (Gmail, Yahoo) or a lookalike domain (ssm-malaysia.com, ssm.gov-my.com) is not SSM.
  • Document format: Official documents are issued exclusively as Digital Certified True Copies (DCTC) in PDF format, each carrying a verifiable QR code.
  • Digital signature: Genuine SSM documents are secured with digital signatures issued by licensed Certification Authorities under the Digital Signature Act 1997, not a scanned stamp or a signature image pasted into a PDF.
  • Payment requests: SSM never asks you to pay a third party or click a payment link inside an approval email. Any legitimate fee is paid through SSM’s own portals.
  • Routing: Real SSM interactions happen through SSM Customer Care, Live Chat, or secure portals such as Ezbiz, MyCoID and MyLLP, not through unsolicited WhatsApp messages from unknown numbers.

📌 How do you verify a QR code on an SSM document?

Building on the DCTC point above, the QR code is your single most reliable check, because it’s the one feature scammers cannot replicate without compromising SSM’s own systems. Scan the code using the official SSM DCTC QR Code Reader app, or use the Web Checker on SSM’s own site, and compare the result against the document you received. If the QR code doesn’t scan, redirects somewhere unrelated to SSM, or the details it returns don’t match the company name or registration number on the document, you’re holding a forged copy. Think of the QR code the way a bank note’s security thread works: the note might look right to the eye, but the thread is the part that’s genuinely hard to copy, so that’s the part you check when something feels off.

📌 How do you independently confirm a company or filing is real?

A related but distinct question is what to do when you’re not just checking an email, but trying to confirm whether a company itself is legitimately registered, for example before signing a contract or receiving a “approval” notice about a company you’re dealing with. For this, don’t rely on anything sent to you. Go directly to SSM’s own lookup tools instead.

  • SSM search company name: Use SSM’s official company name search to confirm a company is actually registered under the name and number it claims, and that the registration status is active rather than struck off or dissolved.
  • SSM e-Info portal: This is SSM’s own information portal where you can pull basic company profile information directly from the source, rather than trusting a PDF attachment someone emailed you.

Cross-checking through these two tools takes a few minutes and removes the guesswork entirely. If the company name, registration number, or status on the official portal doesn’t match what’s in the email or document you received, stop and don’t act on it.

📌 Why do scam emails always create urgency?

Urgency is a deliberate tactic, not a coincidence. Scammers know that a business owner given 24 hours to “avoid penalty” is less likely to pause and verify. The real timelines are far less dramatic. Company registration through SSM typically takes 1 to 3 working days, and Annual Returns are generally due within 30 days of your incorporation anniversary [Companies Act 2016, Section 68]. Neither of these is a same-day, pay-immediately situation. If an email tells you a filing must be paid or confirmed within hours or your company will be suspended, that mismatch with normal SSM processing timelines is itself a red flag worth pausing on.

📌 What happens if you act on a fake document without checking?

Stepping back from spotting the fake itself, it’s worth understanding what’s at stake if you don’t catch it. Acting on a forged SSM document, whether by paying a fraudulent fee or submitting falsified information based on it, can expose you to real financial loss and, separately, legal risk if you unknowingly submit false information to SSM yourself. Under the Companies Act 2016 [Sections 591 and 593], falsifying SSM documents or submitting false information may face a fine of up to RM3 million, up to 10 years imprisonment, or both, upon conviction. For businesses still registered under the Registration of Businesses Act 1956, similar offences carry fines of up to RM50,000 and up to 2 years imprisonment upon conviction. These are maximum penalties a court may impose, not automatic charges, but they underline why a two-minute verification step is worth the time before paying anything or forwarding a document onward.

📌 What should you do the moment you suspect a fake?

  1. Don’t click any links or download attachments beyond the initial PDF you already received.
  2. Check the sender domain is exactly @ssm.com.my.
  3. Scan the QR code using the SSM DCTC QR Code Reader app or Web Checker.
  4. Cross-check the company name and registration number using the SSM search company name tool or the SSM e-Info portal.
  5. If anything doesn’t match, report it to SSM Customer Care directly rather than replying to the suspicious email.
  6. If the email relates to your own company’s filings, confirm with your company secretary whether the filing is genuinely due.

📌 Frequently Asked Questions

How can I tell if an SSM email is real?

Check that it comes from @ssm.com.my, contains no payment link, and that any attached document has a scannable QR code consistent with a Digital Certified True Copy.

What is a DCTC and why does it matter?

DCTC stands for Digital Certified True Copy. It’s the only format SSM issues official documents in, and it’s secured with a digital signature and a QR code you can independently verify.

Can I check if a company is really registered with SSM?

Yes. Use the SSM search company name function or the SSM e-Info portal to pull the company’s status, name, and registration number directly from SSM’s own records.

Does SSM ever call or WhatsApp me directly asking for payment?

Official SSM communication runs through SSM Customer Care, Live Chat, and portals like Ezbiz, MyCoID and MyLLP. An unsolicited WhatsApp message demanding payment is a common scam tactic, not standard SSM practice.

What’s the real deadline for filing an Annual Return?

Generally within 30 days of your company’s incorporation anniversary [Companies Act 2016, Section 68]. Scam emails often invent shorter, more alarming deadlines to pressure you into acting fast.

What if I already paid a scammer posing as SSM?

Stop further contact with that email or number, keep all evidence, and report it to SSM and the relevant authorities. Separately, check your company’s actual filing status directly through SSM’s own portals so you know what, if anything, is genuinely outstanding.

Does a missing or vacant company secretary make these scams more likely to succeed?

It can, because without a company secretary actively tracking your filings, a business owner is more likely to be unsure what’s genuinely due and more susceptible to a fake urgent notice. The underlying SSM deadlines keep running regardless, and directors remain responsible for making sure filings are accurate and on time.

ABOUT BOSS BOLEH

Boss Boleh is a licensed company secretary and online incorporation platform built for first-time entrepreneurs. Beyond company secretarial work, it also offers a one-stop compliance solution for entrepreneurs, including accounting, tax planning and tax filing services. We handle Annual Return and Beneficial Owner submissions to SSM for clients every day, and support company bank account opening online with no branch visit, standard corporate resolutions, and digital signatures with eKYC.

References

You’re welcome to join our community group to get exclusive and latest trend of business insight!

â‘  Join EN group

â‘¡ Join CN group

Want to learn more about managing your business structure the right way? 💼

Join our FREE webinar! We’ll walk you through compliance essentials and how to convert from Enterprise to Sdn Bhd with confidence.

Click here to register for [CN Webinar]

For more details, feel free to WhatsApp us!

📲 WhatsApp: 018-7678055