Bulk WhatsApp number check for Malaysian customer lists (+60)

To check a list of Malaysian numbers for WhatsApp, convert every row to E.164 (+601…), remove duplicates, upload the file as a bulk job with the whatsapp check, read the free estimate, and download one answer per number: registered, not registered or unknown. The Malaysian detail that breaks most lists is length: mobiles have 9 digits after +60, but 011 numbers have 10. Check only numbers your customers gave you, for a purpose you told them about, as the Personal Data Protection Act 2010 (PDPA) requires, and never use the answers to find new people to message.

This guide covers what is specific to Malaysia. The general flow is in our bulk WhatsApp number check guide, and the full numbering plan is in our Malaysia phone number format guide. Facts are as of 7 November 2026, and every price carries its date. This is general guidance, not legal advice.

How do you format Malaysian numbers for a WhatsApp check?

Use the international form: +60, then the number without its leading 0. Malaysian exports mix several spellings of the same mobile:

Here Malaysia is kinder than its neighbour. In our Indonesia guide we showed that a default country can turn a number without a plus into a different, valid number. We ran the same test for Malaysia on 2026-11-07 with libphonenumber-js 1.13.13: we generated 85,550 valid Malaysian mobile numbers across the numbering plan and parsed each in four spellings (01X…, 601X…, 1X… and 00601X…) with Malaysia as the default country. Every spelling came back as the same +60 number, with no mismatches. So for a Malaysian file, setting the default country to MY is safe, and it is required: without it, the API reads a row without + as an international number, and 012XXXXXXX can't be parsed at all.

The converter below does the work for a mobile list. It returns null for anything that isn't a valid Malaysian mobile, and keeps foreign numbers that carry their own +:

import { parsePhoneNumberFromString } from "libphonenumber-js/max";

/** One Malaysian list cell → E.164 mobile (+601…), or null. */
export function toE164My(raw) {
  const p = parsePhoneNumberFromString(String(raw).trim(), "MY");
  return p?.isValid() && p.getType() === "MOBILE" ? p.number : null;
}

We ran it on 2026-11-07 with Node 24 and libphonenumber-js 1.13.13, on libphonenumber's own example numbers. Digits are masked with X:

The first five rows are the same customer. After conversion they collapse into one number, which is what makes the duplicate count honest. If your list should hold only Malaysian customers, filter out results that don't start with +60.

Why does an 011 number have an extra digit?

Most Malaysian mobile codes (010 and 012 to 019) are followed by seven digits, so the number has 9 digits after +60. The 011 range was opened later with eight-digit subscriber numbers, so it has 10. libphonenumber's metadata for Malaysia (region MY) accepts both lengths for mobiles, and also allows the longer length in parts of a few other blocks. Our Malaysia format guide counts exactly which sub-blocks are mobile.

Three consequences for a WhatsApp list:

• Don't filter by length. "Must be 10 digits with the 0" deletes every valid 011 customer; "must be 11" deletes everyone else. Let the numbering metadata decide.
• 015 isn't a mobile block. It holds VoIP ranges. A 015 number can be valid and still not be a mobile, so the converter above drops it from a mobile list.
• The prefix doesn't name the network. Mobile number portability has run in Malaysia since 2008, so 01X shows only the operator the range was first given to. MCMC's public MNP Check website was discontinued with effect from 8 May 2026 (MCMC notice). If the current network matters for routing, use an MNP lookup.

How do you check a list of Malaysian numbers on WhatsApp?

Five steps, from export to answers:

1. Export only customers who gave you their number, with your own ID column (for example crm_id,phone). Leave out bought lists, scraped numbers and number ranges.
2. Convert and dedupe. Run every cell through a converter like the one above, or upload with the country set to Malaysia. Keep the rows that return null aside for a manual fix.
3. Estimate. Upload the file in the dashboard (Bulk jobs › Upload a list), which asks for a country for numbers written without +, or send the numbers to POST /v1/jobs/estimate with "default_country": "MY". The estimate is free, checks nothing and stores nothing.
4. Run with a cost cap. Start the job with max_cost set to the estimate. Choose whatsapp, or whatsapp.business if you also need to know whether the account is a WhatsApp Business account.
5. Download and join back. The result file keeps your row order (row_no); join it back to your own IDs by row number. Store each answer with its checked_at date.

A job holds up to 50,000 numbers, and a dashboard file can be up to 10 MB. Bigger exports go into several jobs.

What does the estimate tell you?

Here is a real estimate for the whatsapp.business check, made with the public sandbox key on 2026-11-07. The sandbox accepts only our test values, which are UK drama-range numbers, so this shows the shape of the answer, not Malaysian data. The last number is the first one again, written without the plus:

curl https://api.mobilevalidate.com/v1/jobs/estimate \
  -H "Authorization: Bearer mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+447700900002", "+447700900003", "+447700900006", "447700900001"],
       "checks": ["whatsapp.business"]}'

Response (abridged):

{
  "object": "estimate",
  "total": 5,
  "valid": 4,
  "invalid": 0,
  "duplicate": 1,
  "checks": ["whatsapp.business"],
  "max_cost": { "amount": "0", "currency": "USD" },
  "breakdown": [
    { "check": "whatsapp.business", "price_mode": "batch", "reason": null, "checks": 0,
      "unit_price": { "amount": "0.0003", "currency": "USD" } },
    { "check": "whatsapp.business", "price_mode": "realtime", "reason": "small_batch", "checks": 4,
      "unit_price": { "amount": "0.004", "currency": "USD" },
      "countries": ["GB"], "batch_minimum": 132 }
  ]
}

duplicate: 1 is the copy without the plus. With no default country, a row of 8 to 15 digits is read as international, so 447700900001 became +447700900001 and was counted once. That is fine for a 6012… cell, but it is why national 012… cells need the country set. max_cost is 0 because test keys are never billed. The small_batch line shows the bulk-price rule: at least 132 numbers from the same country in one job. Fewer than that per country group are checked the real-time way at the real-time price. In a Malaysian file this mostly concerns the handful of +65 or +62 customers; the estimate lists them on their own line before you spend anything. Details are in the bulk jobs docs.

What does it cost?

From our public catalog (GET /v1/services), fetched on 2026-11-07:

Only conclusive answers are billed. Unknown, invalid, duplicate and unsupported rows are free, and so are repeats served from your account's cache. The pricing page always has the current prices.

A worked example with made-up figures: a 30,000-row export converts to 27,400 unique valid Malaysian mobiles. The WhatsApp job costs at most 27,400 × US$0.00025 = US$6.85, or 27,400 × US$0.0003 = US$8.22 with the Business flag. If 4,000 come back not registered and you want to know which still work before you send SMS, an HLR job on those 4,000 costs at most US$20.00.

What share of Malaysian numbers are on WhatsApp?

No public source gives a share you could apply to your list, and we don't publish one. DataReportal's Digital 2026 report for Malaysia, based on data available in October 2025, counts 44.0 million cellular mobile connections, equal to 122% of the population, 35.4 million internet users (98.0%) and 30.7 million social media user identities (85.0%) (DataReportal). It gives no figure for WhatsApp.

The 122% matters most for a list: many customers hold more than one line. The rules on that tightened in 2026. On 26 February 2026 MCMC registered a mandatory standard for prepaid registration that, as Bernama reported, caps prepaid SIMs at five per person per operator for citizens and permanent residents and two for non-citizens, uses biometric checks, and ends tourist SIMs after at most three months (Bernama, 2026). For a WhatsApp list that means two things. The number a customer typed may not be the one their WhatsApp account is on. And a number collected from a visitor can stop working within a quarter, so an old registered answer for it says little. A check of your own list, dated, beats any national average.

Is WhatsApp cheaper than SMS for OTP in Malaysia?

For most senders based in Malaysia, the WhatsApp list rate is low. From Meta's rate card effective 1 October 2026, in our dataset:

Three Malaysian specifics:

• The cross-border rate applies to Malaysia. Meta lists Malaysia among the markets with an authentication-international rate since 1 February 2025. A business pays it when it is eligible, is based in another country than the recipient, and the message was delivered after its start date. A business becomes eligible once it sends more than 750,000 messages outside customer service windows in a moving 30-day period to users in such markets (Meta). A Singapore-based app sending codes to +60 users at that volume pays three times the local rate.
• Marketing is expensive. Malaysia's marketing rate, US$0.0860, is one of the five highest of the 46 rows on that card. A pre-check that removes numbers without WhatsApp from a campaign to opted-in customers saves little per message (undelivered messages aren't charged), but it tells you how many customers you can reach at all.
• SMS can't carry links. On MCMC's direction, Malaysian operators block SMS that contain links, phone numbers or personal details, for person-to-person and application-to-person traffic. MCMC's short-code exemption was revoked from 1 September 2024, and blocked messages can't be unblocked (CelcomDigi; MCMC, 2023). A plain OTP still works by SMS; a delivery update with a tracking link doesn't.

Meta charges only for delivered messages, and bills in Malaysian ringgit (MYR) since 1 April 2026 if you choose it (Meta pricing). We don't quote SMS prices here: they vary by route and contract, so compare with your own invoice. Our WhatsApp OTP vs SMS OTP cost guide has the formula for cost per verified user.

What does Malaysia's PDPA require before you check or message?

We read the Act, the 2024 amending Act and the commencement order on 2026-11-07. The points that touch a number check:

• A customer's number is personal data, and the PDPA applies to its processing in commercial transactions (JPDP, Act 709).
• Consent is the general rule. The General Principle (section 6) lets you process personal data with the person's consent or where processing is necessary for a listed purpose, such as performing a contract with them or complying with a legal obligation. Unlike Indonesia's law or the GDPR, the PDPA has no general legitimate-interests basis.
• Tell people the purpose. The Notice and Choice Principle (section 7) requires a written notice of the purposes, among other items. If you check which channel reaches a customer, say so in your privacy notice.
• Direct marketing can be stopped. Under section 43, a person can require you in writing to stop processing their data for direct marketing. A registered answer doesn't change that.

The Personal Data Protection (Amendment) Act 2024 (Act A1727) received Royal Assent on 9 October 2024 and was gazetted on 17 October 2024 (Act A1727). The Minister brought it into force in three stages by notification P.U. (B) 522, dated 19 December 2024 (Federal Gazette). All of it was in force by June 2025:

Two of those changes matter for a check. A checking service is your data processor, so it now carries the security duty itself, and it must have a data protection officer. And a leak of a customer list you uploaded somewhere is now a notifiable breach. Choose a processor with a data processing agreement and short retention.

Telecom rules sit next to the PDPA. The Communications and Multimedia (Amendment) Act 2025 added section 233A against unsolicited commercial electronic messages, and MCMC's consultation paper of 13 August 2025 proposed regulations that would cover SMS, e-mail and internet messaging services: express consent or a recent customer relationship, a free opt-out in every message, sender identification, an <ADV> label, and a ban on address harvesting and on "dictionary attacks" that guess addresses (MCMC, 2025). On 2026-11-07 we couldn't confirm from official sources that section 233A or those regulations are in force. Treat them as the direction of travel.

WhatsApp's own rules add a layer. Its Business Messaging Policy says you may contact people only if they gave you their number and opted in to receive messages from you (WhatsApp), and Meta's opt-in guide requires the opt-in to name your business (Meta for Developers). A registered: true answer is a fact about the number, not permission to message it. Our consent and law guide compares the PDPA with other regimes.

On our side, requests with long runs of consecutive numbers are refused as suspected enumeration, each account has a daily cap, and our acceptable use policy forbids unsolicited bulk messaging and range checks. Anyone can object through the opt-out form.

What do you do with numbers that are not on WhatsApp?

Route them to a channel that reaches them, and keep the answer:

For the not-registered group, an HLR check answers the next question: is the number reachable on its network at all? That matters in Malaysia for tourist and second SIMs, which lapse. Treat unknown as missing data, never as a dead number, and don't overwrite a stored conclusive answer with an unknown one. Our list cleaning guide shows how to combine the checks. Re-check before each campaign to opted-in customers, oldest answers first.

How do you start with MobileValidate?

The checks for this guide are WhatsApp number check, WhatsApp Business check, live network status (HLR) and MNP lookup. All take Malaysian numbers in real time and in bulk jobs. You don't need a WhatsApp account, a phone or a QR pairing.

• Free, today. Get a free test key to build against fixed test answers, and run the free estimate on any file before you pay. To see the line type and network of a single number, the carrier lookup page gives 3 free lookups a day without sign-up.
• Real checks free. Every live account can check 20 phone numbers and 10 e-mail addresses for real, free, on the dashboard's Try it page. Request access to open one.
• Then prepay. Top-ups of US$100 or more get a 5% bonus, US$500 or more 8%, and US$2,000 or more 10%.

Results are kept for your account's retention setting, 30 days by default, and you can delete a job's results at any time. WhatsApp is named descriptively; MobileValidate is not affiliated with WhatsApp, Meta or any Malaysian regulator or operator.

What are the key takeaways?

• Convert every row to +60… before upload, or set the default country to MY: in our test of 85,550 numbers, all four common spellings mapped to the same number.
• Malaysian mobiles have 9 digits after +60, or 10 for 011. Never filter by one length, and keep 015 VoIP numbers out of a mobile list.
• Bulk WhatsApp checks cost US$0.25 per 1,000 (catalog, 2026-11-07), with at least 132 numbers per country group in one job for the bulk price. Unknowns and duplicates are free.
• A WhatsApp authentication message to Malaysia lists at US$0.0140; foreign senders above Meta's threshold pay US$0.0418. SMS can't carry links.
• The PDPA makes consent the general rule, and since June 2025 it adds processor security duties, data protection officers and breach notification. Check your own customers' numbers, never bought or scraped lists.