Is this donation appeal genuine? What to check before you give online or on the street

1. What kind of organisation is asking

Malaysia gives an NPO one of three legal identities: a society, registered with the Registrar of Societies (ROS), defined as a club, association or body of seven or more persons ^{[1, s.2]}; a company limited by guarantee (CLBG), incorporated with SSM, whose name carries "Berhad" or "Bhd" by default ^{[2, para 4]}; or incorporated trustees, created under the Trustees (Incorporation) Act 1952 through BHEUU ^{[3, s.2(3)]}. A genuine organisation should give you its full legal name, registration number, and which of the three it is — Society vs Company Limited by Guarantee covers what each means.

Worth knowing for a "Berhad"/"Bhd" fundraiser: SSM's rules prohibit a CLBG from soliciting "any contribution or donation" from the public unless approved by the Registrar ^{[2, para 24(b)(iv)]} — and SSM publishes a list of the CLBGs it has approved to do this ^[9], a checkable fact.

A promised tax deduction is a separate claim. Only an organisation currently approved by LHDN under subsection 44(6) of the Income Tax Act 1967 can issue a receipt letting you claim one, using a receipt format LHDN has separately approved ^[7][8]. See Is my donation tax deductible?, and Donation receipt lost or fake? if you already hold a receipt.

Practical tips:

• Ask for the organisation's full legal name and registration number, not just a cause name.
• A "Berhad"/"Bhd" company asking the public for money needs the Registrar's prior approval — ask about it.
• Treat "this is tax deductible" as its own claim to check, separate from the organisation's legitimacy.

2. A street or door-to-door collector: ask to see the licence

Physical collection — house to house, premise to premise, or a street or public place with a donation tin — falls under the House to House and Street Collections Act 1947, which requires a licence ^[4]. It's an old law, last reviewed in 1978, but still the rule that applies today. It's reasonable to ask to see it before you give.

This requirement is specifically about soliciting the public in the street or door to door. A donation box inside an organisation's own premises — at a temple, say, or during its own service — is a different situation ^[4].

Practical tips:

• Ask a street or door-to-door collector to show their collection licence before you give.

3. Giving online: no permit needed for that channel, but check what you're paying into

Unlike a street collection, there's no specific permit required for collecting donations online — regulators have themselves acknowledged there's no such policy ^[4]. So a WhatsApp forward, social post or donation page with no visible permit isn't itself a red flag; that's simply how the law stands. Check instead whether it points to a real, registered organisation (section 1), rather than only a personal account number in a chat. Fundraising in Malaysia covers the full landscape.

One label is worth knowing. Malaysia's Securities Commission regulates a "Social Exchange Platform" (SEP), a registered channel some NPOs use to raise funds for defined projects. Only an SC-registered entity may call itself a "social exchange platform" or hold itself out as operating one ^{[10, para 5.02]}, so if an appeal uses that term, check it against the SC's register. Using an SEP is optional ^{[10, para 2.01]} — an appeal that doesn't mention one isn't less legitimate for that reason alone. Malaysia's Social Exchange Platform explained has the full detail.

Practical tips:

• Look for a donation page under the organisation's own name, rather than only a personal account number shared in a chat or post.
• If an appeal specifically calls itself a "social exchange platform," that's a checkable, regulated term — verify it against the SC's register.

4. Whose account the money is actually going into

A payment gateway processing donations must verify who it's onboarding — "relevant background information on the merchant," "legitimacy of the merchant's business," confirmation it hasn't been blacklisted — before it will process for them ^{[5, §11.1]}, and hold settlement funds in a dedicated account, kept separate from the acquirer's own funds ^{[5, §10.5]}. For a club, society or charity specifically, BNM's rules require the bank or gateway to obtain its registration documents and verify whoever is authorised to represent it ^{[11, §14A.9.17]}. In other words: your money should be settling into an account that's identifiably the organisation's own, not a named individual's. What a payment gateway asks of your NPO has the full detail.

There's a further distinction for an online QR code. A static QR, generated once and reused for every scan — a laminated poster by a collection box, say — doesn't tie any scan back to a particular donor or gift, because nothing on the collector's side is expecting that specific payment ^[6]. A dynamic QR, generated fresh for one donation at a time through a checkout, is different: because it was created for that one gift, it can be linked back to a donor and a receipt ^[6]. That doesn't make a static QR fake — nothing in PayNet's own material says it can't be used for donations — but you shouldn't expect the same receipted, donor-linked record from a poster scan that you'd get from an actual checkout ^[6]. Online donation payment methods goes deeper.

Practical tips:

• Ask whose account the money settles into — it should read as the organisation's own account, not a personal name.
• A QR code that's identical for every donor (a poster or laminated sign) can't confirm your specific gift was received; a checkout that generates a fresh code for your one donation can.
• Prefer a proper checkout over a bare bank transfer to an unfamiliar personal account.