STR 2027 Scam Warning: Fake Websites, WhatsApp and the Official Portal

Verified 25 October 2026. STR 2027 applications are open, but fraudulent STR/SARA websites, social media pages, private WhatsApp messages and impersonation calls are also a concern. Malaysia's Inland Revenue Board (HASiL / LHDN) has published an October 2026 warning on its official STR portal.

Three things to know immediately

First, applying for STR 2027, updating an application and checking its status are free. A request for an activation fee or a paid fast-track appointment is a major warning sign.

Second, the official portal is bantuantunai.hasil.gov.my. Navigate there yourself, rather than following a link from an unsolicited message.

Third, HASiL says it has not appointed individuals to answer STR questions via private WhatsApp or personal phone numbers. It also does not send roaming officers to people's homes to offer STR application, update or status-checking services.

The official STR toll-free number, 1-800-88-2747, is not used for ordinary unsolicited outbound calls. Any legitimate callback follows an earlier request to the hotline with prior notice, according to the official warning.

Five checks before you enter personal information

1. Check the domain, not the logo. A copied government logo or polished design is easy to reproduce. Type the official address in your browser.
2. Watch for fees. HASiL says STR applications, updates and checks carry no charge.
3. Never provide banking passwords, PINs or OTP/TAC codes to someone contacting you about STR. Even a page that asks for an IC number should be checked for its official domain first.
4. Be wary of private WhatsApp assistance and home visits claiming to represent HASiL.
5. Ignore artificial deadlines. Messages claiming you must act in minutes to avoid losing your benefit should be independently checked through the official portal.

A screenshot comparing a “real” and “fake” website can become outdated. The browser's actual address bar, checked against the government portal, is a more reliable starting point.

How to use the official STR 2027 portal

Open Portal Rasmi STR directly. Use its actual navigation for a new application, account login, update or status check as relevant. Read the latest official eligibility notices before entering any information and keep your confirmation.

At the time of writing, the official site says STR 2027 applications have been open throughout the year from 15 October 2026. Applicants who have not updated their applications for three consecutive years are instructed to update their STR 2027 details. Always check the portal for changes to eligibility and procedure.

For a separate step-by-step explanation of the application opening dates, see JomGuide's STR 2027 application guide.

Already clicked a suspicious link?

Opened it but entered nothing? Stop, close the page and avoid installing files or apps suggested by the message. Go back to the official portal independently.

Entered credentials or an OTP? Stop interacting with the sender. Use official account-recovery routes to secure affected accounts, and contact the relevant service provider. Never give additional codes to someone claiming they can “reverse” the damage.

Money was transferred or you see an unauthorised transaction? Immediately contact your bank's official fraud hotline or NSRC 997. Report the incident to police and preserve transaction records. The Malaysian government lists 997 as operating 24 hours daily as of 2026. This is an emergency financial-scam response channel, not an STR eligibility helpline. See JomGuide's scam response guide.

Helping parents or less confident internet users

Bookmark the government portal on their device. If a caller offers to “handle everything,” end the call and contact the hotline listed on the real site. A trusted family member can help verify the address without asking the applicant to share passwords or one-time codes.

Quick answers

Is there an STR application fee? No. HASiL says new applications, updates and status checks are free.

Will officials visit my home to handle the application? Not as an official roaming STR application service, according to the warning.

Can a WhatsApp profile picture prove the sender works for LHDN? No. Use the official portal's contact channels.

Sources: Official STR portal · HASiL October 2026 warning · Malaysia Government NSRC 997.