Malaysians who are or have been victims of cybercriminals operating overseas are able to take legal action against those nefarious actors. Specifically, they could take action if the offences involved Malaysian systems or if the victims are Malaysian citizens.
Datuk Seri Dr Ahmad Zahid Hamidi, Deputy Prime Minister, explained in a written reply on the Parliament website that taking legal action against cybercriminals overseas is possible through Clause 2 of the Cyber Crime Bill 2026.
“The government is leveraging existing international cooperation mechanisms to ensure that foreign-based criminals can be investigated, prosecuted and, where the requirements are met, extradited to Malaysia,” he said in a written reply posted on the Parliament website.
The Cyber Crime Bill 2026 was passed earlier this year, on 1 July 2026. The bill replaces the old and outdated Computer Crimes Act 1997, and allows Malaysians and their government to address modern threats, such as AI-driven scams, deepfakes, identity theft, and attacks on critical infrastructure. Many of these threats are encased within Clause 23 of the bill.
Clause 2 of the bill, known as the Extra-Territorial Jurisdiction, is the clause that allows Malaysians to prosecute foreign cybercriminals if their actions directly affect the country’s infrastructure or citizens.
To put this in another way, the bill expands Malaysian jurisdiction outside of its borders, similar to how a criminal case becomes US jurisdiction the moment it is determined that the US dollar is involved in the matter.
The Deputy Prime Minister also explained that, in order to expedite action against cybercrime syndicates, the bill also provides investigative powers under Clauses 38 through 41, which cover preservation and disclosure of data, collection of traffic data, and the interception of communications, subject to prescribed safeguards.
