Offline flagged-account list
local_reports
Matches on account number
A list of accounts already reported as scams, held in memory. Every entry has to carry a cited source or it's dropped when the list loads.
Know who you're paying,
before you pay them.
Malaysia already has scam-account databases. Nobody checks them at the one moment it matters — the second before you hit confirm. Semak QR floats over your banking app, reads the payment screen you're already looking at, and tells you in one sentence whether that account has been reported.
Nothing is kept. The screenshot, the name and the account number are processed in memory and discarded with the response.
DuitNow QR
Align the code within the frame
Bank appDuitNow QR
You're paying
RM 350.00
ToGLOBAL WIN MARKETING ENT
Account7291 8845 53
ReferenceBarang online
Confirm payment
Checking this account…
- Scam-report database
- Bank Negara alert list
- Live web search
Don't pay this one
This account was flagged 3 times in scam-report checks.
Scam database: 3 reports · most recent 11 days ago
The bubble sits on top of your banking app. Your bank's own screen is never touched.
Three steps, and two of them you already do.
Semak QR doesn't replace your banking app or ask you to retype an account number into some website. It works on the screen you're already staring at.
01
Scan as usual
Open your banking app, scan the DuitNow QR, and let it show the confirmation screen with the recipient's name and account number. Screenshot it. Nothing about how you pay changes.
02
Tap the bubble
The floating bubble picks up the new screenshot and reads the name, account number and amount off it. That account then goes to scam-report checks, the Bank Negara alert list and a live web search — all at once, in a few seconds.
03
Get a plain answer
Not a risk score. One sentence you can read in two seconds — “this account was flagged 3 times” or “no scam reports found” — with the evidence sitting underneath it if you want to look closer.
What we did when the data source said no.
The plan was one lookup: PenipuMY, a real Malaysian community scam database. Their API issues keys by approval, and ours didn't arrive in time. So rather than wait for permission, we rebuilt the check on four independent sources — and the two doing the heavy lifting need no API key at all.
Bank Negara alert list
bnm_alert_list
Matches on recipient name
Bank Negara's published Financial Consumer Alert List — 601 entities, refreshed daily upstream. A hit means the payee's name matches a company BNM has warned the public about.
PenipuMY scam database
scam_database
Matches on account number
Fully wired and dormant. The day our API key is approved it drops back in through a single environment variable — no code change.
Live web search
web_search
Matches on number and name
Exa neural search, for accounts too new to have been reported to any database yet.
All four run in parallel, and each one reports its own status. That matters more than the count: a check that couldn't run is never reported as a clean result. The two keyless sources mean a verdict still has real evidence behind it even when every remote lookup is unavailable — and when nothing can be confirmed, it says so instead of telling you the account looks fine.
See it catch one.
A full run on a real Android phone: scan, screenshot, bubble, verdict — start to finish, no cuts.
Demo videoFootage drops in here before judging.