Defamed by an Anonymous Account in Malaysia? How to Unmask Them and Fight Back
- Gandhi Palanisamy
- Jun 10
- 11 min read
It usually starts with a screenshot from a friend. A fresh account with no profile photo, or a stolen one, is posting things about you that are simply not true. Maybe it is a fake page accusing your business of cheating customers. Maybe it is a burner TikTok account stitching your videos with lies, or someone in a Telegram group spreading a story about your private life under a name you have never heard of.
The lies are bad enough. What makes it feel hopeless is the mask. You cannot send a lawyer's letter to "@user84629". You cannot sue a cartoon avatar.
Here is what most victims never get told: anonymity is a tactic, not a shield. Malaysian law has real tools for this, and most of the first steps cost you nothing. This guide walks you through them in the right order. If you want the foundations first, our complete guide to defamation law in Malaysia covers what defamation is and what you must prove.
Quick answer:
Save your evidence first. Free. Do it today, before you report anything.
Report the account to the platform. Free. New laws now force the big platforms to respond.
Report it to MCMC. Free.
Make a police report. Free, and the police can trace accounts in ways you cannot.
If the harm is serious, ask the court to unmask them. Powerful, but this step needs a lawyer, court papers and real costs.
Once they have a name, you can sue for damages and removal.
Can You Fight Anonymous Defamation in Malaysia?
Yes. Not knowing who defamed you does not kill your claim. The courts can order the people who do know, usually the platform or the internet service provider, to reveal who is behind the account. In serious cases, Malaysian courts have even allowed legal action against defendants named only as "persons unknown".
But here is the part that matters for ordinary people: you do not start in a courtroom. You start with the steps that are free and fast, and you only bring in the heavy machinery if the harm is serious enough to deserve it. The order you do things in matters more than most people think.
First 48 Hours: Save the Evidence Before It Disappears
Capture everything before you report anything. Reporting can get content removed, and removal destroys the very evidence your case is built on.
Most people's first instinct is to hit the report button. Do that second. First, build your file:
Full screenshots of every post, comment, story and message, showing the account handle, the date and the time
The direct link (URL) of the account profile and of each post
Screen recordings for videos, stories and anything that scrolls
A list of people who saw the content, because you must later prove that others actually saw it
A simple log: what appeared, where, when, and who shared it onward
Do not reply, do not threaten the account in the comments, and do not post your own counter-story while emotions are high. Your replies can spread the lie further, and they will be read back to you later. If the content includes AI-generated images or video, there are extra steps, and we cover those in our guide on AI deepfake defamation in Malaysia.
Step One: Report It to the Platform. The Law Now Backs You Up.
Once your evidence is safe, report the account and every post through the platform's own reporting tools. This is free, and since this year it is no longer a polite request into the void.
The Online Safety Act 2025 came into force on 1 January 2026. The big platforms operating in Malaysia must now run working report channels and respond to reports within set timeframes, and new codes that took effect on 1 June 2026 tightened those duties further. A platform that ignores its obligations can be fined up to RM10 million. In short, your report now lands on a desk the law is watching.
One honest note from us, because you will not read it elsewhere. The Act does not list "defamation" by name as a category of harmful content. But it does cover content that harasses, threatens or causes distress, and an anonymous smear campaign almost always fits that description too. So when you report, use the harassment and abuse categories where the content genuinely fits them. The defamation claim itself stays for the courts.
Step Two: Report It to MCMC. Free.
You can also report the content and the account to the Malaysian Communications and Multimedia Commission, and it costs nothing. MCMC accepts complaints through its official complaints portal, by WhatsApp at 016-220 6262, or through its hotline at 1800-188-030.
MCMC is a regulator, not a court. It can push platforms on harmful content, act on breaches of the laws it administers, and open investigations alongside the police. What it cannot do is decide your defamation claim or award you compensation. Think of the MCMC report as pressure plus paper trail: it creates an official record that you acted promptly, and that record serves you later.
For many people, the platform report and the MCMC report together get the content taken down. If the account keeps coming back, or the damage to you is serious, keep going.
Step Three: Make a Police Report. It Costs Nothing and It HAS BENEFITS.
Anonymous defamation can be a crime as well as a civil wrong, and lodging a police report (laporan polis) is free. This step matters more than most people realise, because the police have investigative powers that no private person has, including the ability to trace accounts and devices.
Two laws do the heavy lifting. Criminal defamation under Sections 499 and 500 of the Penal Code carries up to two years' imprisonment, a fine, or both. And Section 233 of the Communications and Multimedia Act 1998, which covers grossly offensive, false or menacing online posts, was amended in 2025 with much heavier penalties: a fine of up to RM500,000, up to two years' imprisonment, or both. If the victim is a child, it goes higher still.
Be clear-eyed about what a police report does and does not do. Whether anyone is charged is the Public Prosecutor's decision, not yours, and a conviction does not put money in your hands. What the report does is start an investigation against the account, put the harm on official record, and add real pressure. Many of the matters we handle run a police report and a civil claim side by side.
When the Free Routes Are Not Enough: The Court Order That Unmasks Them
Now the heavy machinery. The High Court can order whoever holds the identifying information, usually the platform, the website operator or the internet service provider, to hand it over to you, even before you file your defamation suit. Lawyers call this pre-action discovery, and it is done under Order 24 rule 7A of the Rules of Court 2012, a rule that exists precisely for identifying the person you need to sue.
Be honest with yourself about what this step involves before you start. It needs a lawyer. It involves court papers, sworn statements, filing fees and legal fees, and it takes weeks to months, not days. If the trail crosses more than one company, you may need more than one order. That is exactly why the free steps come first. For a one-off nasty comment, this route is usually not worth it. For serious harm, to your business, your career or your family's name, it absolutely can be.
Here is how it works in plain terms. Your lawyer applies to the High Court for an order against the company that holds the information, and the court will grant it if you show a genuine claim and a real need, not a fishing expedition. Malaysian courts have been making these orders for years. In Stemlife Bhd v Bristol-Myers Squibb (M) Sdn Bhd [2008] 6 CLJ 200, the High Court ordered a website operator to reveal the details of anonymous posters. What you typically get is the account's registration details, email addresses, phone numbers and IP logs. If that produces an IP address, a second order against the internet service provider turns it into a name and address.
If you are weighing up whether your situation is serious enough for this step, that is exactly the conversation to have with a lawyer before spending anything. You can speak to our team in Penang at 04-505 0420 and we will tell you honestly whether your case justifies it.
The Law That Points the Finger: Section 114A
Once the trail produces a name, a photo or an internet account, Section 114A of the Evidence Act 1950 does something powerful: the law presumes that person published the content, unless they can prove otherwise.
In simple terms, the presumption catches three kinds of people: the person shown as the owner or admin of the page, the person whose internet account the posts came from, and the person whose device was used. The burden then flips onto them to explain themselves.
Most people don't realise how far the second one reaches. The fake account does not need to be in the defamer's real name. If the posts can be traced to an internet line, the subscriber of that line starts the case as the presumed publisher.
The case that shows the whole machine working end to end is Tong Seak Kan & Anor v Loke Ah Kin & Anor [2014] 6 CLJ 904.
The victims were defamed on two anonymous blogs. They obtained a court order in California compelling Google to reveal the IP addresses behind the blogs. Telekom Malaysia then identified the Malaysian subscriber of those addresses. Back in the Malaysian High Court, Section 114A presumed the subscriber was the publisher, and the anonymous blogger was anonymous no more.
That is the template: platform first, then the internet service provider, then the presumption. Every step has been done before in a Malaysian courtroom.
For Serious Cases: Suing "Persons Unknown"
Malaysian courts have also accepted lawsuits against defendants nobody can name yet, described instead by what they did. In Zschimmer & Schwarz GmbH & Co KG Chemische Fabriken v Persons Unknown [2021] 7 MLJ 178, the High Court granted injunctions against "persons unknown" behind an email fraud, and allowed the court papers to be served on them by email.
The same line of cases produced the Spartacus order, a court order compelling the unknown defendant to come forward and identify himself. These tools were forged in fraud cases and they sit at the serious end of the toolbox, for situations where the harm is ongoing and you cannot afford to wait out the unmasking process. If your case ever needs them, you will already have a lawyer guiding you there.
Once They Are Unmasked: What You Can Claim
After identification, your case becomes a normal defamation suit, and the mask they hid behind often works against them. Hiding behind a fake account is conduct a court can weigh when deciding damages, because it points to malice.
Your remedies are damages for the harm to your reputation, a court order to remove the content and stop further posts, and in some settlements a public apology. How much you can claim depends on how serious the lie was, how far it spread, who you are, and how the defamer behaved. We break down the factors Malaysian courts weigh in our practical guide to defamation damages in Malaysia.
Expect the unmasked defendant to reach for the usual defences: truth, fair comment, privilege. We explain how those work, and how they fail, in our guide on defamation defences in Malaysia.
What If the Platform Is Overseas?
Harder and slower, but far from hopeless. Malaysian internet service providers comply with Malaysian court orders, which is how Telekom Malaysia ended up identifying the blogger in Tong Seak Kan. The friction sits with the foreign platforms.
Meta, TikTok, Google and the rest maintain legal request channels for exactly these orders, and they do respond, though on their own timelines and sometimes only to orders from their home courts. That is why the victims in Tong Seak Kan took the California detour before finishing the job in Malaysia. Some platforms, Telegram being the recurring example, are slower and less cooperative, and there the strategy leans harder on the free routes: the Online Safety Act reporting framework, MCMC, and the police.
The right move depends on which platform, what was posted, and how fast it is spreading. There is no one answer, but there is almost always a route.
Frequently Asked Questions
How do I find out who is behind a fake account in Malaysia?
Save the evidence first, then work the sequence: report to the platform and MCMC, make a police report, and if the harm justifies it, apply through a lawyer for pre-action discovery under Order 24 rule 7A of the Rules of Court 2012 against the platform or website operator. If that produces an IP address, a follow-up order against the internet service provider identifies the subscriber. Section 114A of the Evidence Act 1950 then presumes the identified person published the content unless they prove otherwise.
Can I make a police report about a fake account defaming me?
Yes, and you should consider it early, because it is free and the police can trace accounts in ways a private person cannot. Bring your screenshots, the links, and a simple timeline. Online defamation can engage Section 233 of the Communications and Multimedia Act 1998 and criminal defamation under the Penal Code.
Is defamation a crime in Malaysia?
Yes. Criminal defamation under Sections 499 and 500 of the Penal Code carries up to two years' imprisonment, a fine, or both. Online posts can separately breach Section 233 of the Communications and Multimedia Act 1998, which since its 2025 amendment carries fines of up to RM500,000 and up to two years' imprisonment. The civil claim for compensation is a separate track, and both can run at the same time.
Is it expensive to unmask an anonymous account?
The first steps cost nothing: platform reports, MCMC complaints and police reports are all free. The court route is different. Unmasking orders involve a lawyer, filing fees and legal fees, and the cost grows with the number of orders needed. That is why we recommend the free routes first, and the court route when the harm is serious enough to justify it. A good lawyer will tell you honestly, before you spend anything, whether your case deserves that step.
Can the court force TikTok or Meta to reveal who owns an account?
Malaysian courts can and do make disclosure orders against platforms and service providers. Compliance is smoothest with companies that have a Malaysian presence, such as local internet service providers. Foreign platforms generally respond through their legal request channels, and in some cases the effective route is an order from the courts of their home country, as happened with Google in Tong Seak Kan v Loke Ah Kin.
What if the account deletes everything after I report it?
This is exactly why saving evidence comes before reporting. Your screenshots, recordings and witness list remain usable evidence even after the original posts vanish. Platforms also keep account and log data for a period after content is deleted, which a court order can still reach, but that window is not forever, so move quickly.
How long do I have to sue for defamation in Malaysia?
Six years from publication, under Section 6 of the Limitation Act 1953. Do not treat that as breathing room. The unmasking trail goes cold much faster than the limitation period, because platforms and service providers keep logs for limited periods.
Someone is claiming an anonymous account that defamed them belongs to me. What now?
Take it seriously even if the claim feels absurd, because Section 114A can presume publication against the registered subscriber of an internet connection, and the burden of disproving it falls on you. The presumption can be rebutted, for example with evidence that others had access to your connection or device. Our guide to defamation defences in Malaysia covers the defences, and this is a situation where you should speak to a lawyer before responding to anyone.
The Mask Comes Off More Often Than You Think
The whole point of a fake account is to make you feel powerless. The law's answer is a sequence: save, report, escalate only as far as your case deserves. Start with the free steps today. Every link in the chain above has been tested in a Malaysian courtroom, and every one of them exists because someone before you refused to accept that an anonymous lie gets the last word.
Need Help With Anonymous Defamation in Malaysia?
Gandhi Syahida & Associates is a litigation firm based in Penang that handles defamation matters across Malaysia, including takedown strategy and the court applications that unmask anonymous accounts. If a fake account is attacking you or your business, the earlier you speak to us, the more options you have, and we will tell you honestly which steps your case actually needs.
Gandhi Syahida & Associates
No. 5, 1st Floor, Taman Idaman, Jalan Idaman, 14100 Simpang Ampat, Pulau Pinang
Phone: 04-505 0420 | WhatsApp: 017-5190049
Email: admin@gandhisyahida.com.my
This article is for general information only and does not constitute legal advice. The law and procedure described may have changed since publication. For advice on your specific situation, please contact our firm or another qualified lawyer.
By Gandhi Palanisamy, Advocate and Solicitor of the High Court of Malaya. Last updated 10 June 2026.
Comments