Malaysia phone numbers: format, mobile prefixes, validation and messaging rules

The Malaysia phone number format uses the country code +60. Mobile numbers start with 1 after the code (01X at home) and have 9 or 10 digits after +60: +60 12 XXX XXXX for most ranges, +60 11 XXXX XXXX for 011, which has one extra digit. Store the E.164 form. Ported numbers keep their prefix, so 01X doesn't tell you today's network, and WhatsApp or SMS checks need a lawful basis under the PDPA.

This guide is part of our phone numbers by country series. The tables are generated from libphonenumber's metadata and our public catalog. Example numbers are masked with X. We read the Malaysian Communications and Multimedia Commission (MCMC) documents cited here on 2026-10-14. This is a summary, not legal advice.

#What does a Malaysian phone number look like?

A mobile number is 01X-XXX XXXX at home: the trunk prefix 0, a two-digit code starting with 1, and seven digits. From abroad it is +60 1X XXX XXXX. The 011 range is the exception that breaks most validators: its subscriber numbers have eight digits, so the national form is 011-XXXX XXXX, 11 digits including the 0 (Wikipedia). Landlines have a one-digit area code in Peninsular Malaysia (03 for Kuala Lumpur, Selangor and Putrajaya) and a two-digit 08X code in Sabah and Sarawak.

Malaysian forms often collect numbers as 012-XXX XXXX, 6012XXXXXXX without a plus, or with a leading +6 typed by hand. A numbering-plan library with the default region MY turns all of them into +601…. Never strip the leading 0 with a regex and prepend 60 yourself: the 011 length difference and the landline codes make that brittle.

#Which prefixes are mobile numbers?

All mobile numbers start 01, but not every 01X block is fully in use. For each two-digit block, the generator counted every 9- and 10-digit number that libphonenumber's mobile pattern for MY accepts:

In short: 012, 016 and 019 are fully mobile, 013 and 017 except their 0 sub-block, and 010, 011 and 014 mostly. 015 and 018 are mostly not mobile. The 015 block holds VoIP ranges, so a 015 number can be valid without being a mobile. A number such as 0150 XXX XXXX has a mobile-looking shape but fails a mobile check.

#Why do 011 numbers have an extra digit?

Each operator was originally given one mobile code. As those codes filled up and virtual operators arrived, the 011 and 015 ranges were opened with eight-digit subscriber numbers instead of seven (Wikipedia). libphonenumber's current pattern also accepts the longer length in a few ranges of 014, 018 and 019. The practical rule: never hard-code "10 digits" for Malaysian mobiles. Accept 9 or 10 digits after +60 and let the metadata decide which ranges allow which length.

#Prefixes and operators

Malaysians often read the prefix as the network: 012 or 017 for one operator, 013 or 019 for another. That reflects the original allocation, and several blocks (010, 011, 014, 018) are split between operators and virtual operators. The merger of Celcom and Digi into CelcomDigi on 1 December 2022 changed the picture again (Wikipedia). We don't publish an operator-by-prefix table here, because it looks authoritative and is wrong for every ported number.

#How do I validate a Malaysian number in code?

Use a libphonenumber port with full metadata and the default region MY.

Python (pip install phonenumbers):

import phonenumbers


def normalize_my(raw: str) -> str | None:
    """E.164 for a Malaysian mobile (01X …), or None."""
    try:
        n = phonenumbers.parse(raw, "MY")
    except phonenumbers.NumberParseException:
        return None
    if (not phonenumbers.is_valid_number(n) or phonenumbers.region_code_for_number(n) != "MY"
            or phonenumbers.number_type(n) != phonenumbers.PhoneNumberType.MOBILE):
        return None
    return phonenumbers.format_number(n, phonenumbers.PhoneNumberFormat.E164)

JavaScript (npm install libphonenumber-js):

import { parsePhoneNumberFromString } from "libphonenumber-js/max";

/** "012-XXX XXXX", "011-XXXX XXXX", "+60 1X …", "601X…" → E.164 for a Malaysian mobile, or null. */
export function normalizeMy(raw) {
  const phone = parsePhoneNumberFromString(String(raw), "MY");
  return phone?.isValid() && phone.country === "MY" && phone.getType() === "MOBILE" ? phone.number : null;
}

We ran both on 2026-10-14 (Python phonenumbers 9.0.41, libphonenumber-js 1.13.13 with metadata 9.0.39). Both returned an E.164 number for rows 1 to 5 below and nothing for the rest; both also accepted an 11-digit 011-XXXX XXXX number and rejected the same number with one digit missing. The shape regex column tests ^(?:\+60|0060|0)?1\d{8,9}$, the pattern most tutorials give, after spaces, dashes and brackets are removed:

Rows 7 and 9 are the ones to remember. A 012 number with an extra digit has the length of an 011 number, so the regex passes it, but no 012 number is that long. And a 015 VoIP number passes the regex but isn't a mobile, so an OTP sent to it by SMS may never arrive. More languages are in our Python and JavaScript guides.

#Does number portability change the carrier?

Yes. Mobile number portability was introduced in Malaysia on 1 October 2008, so a number's prefix shows only its original provider (Wikipedia). MCMC set the framework after a public inquiry; its December 2005 report discusses a central clearinghouse, porting times and a postponement of the launch to 2008 (MCMC, 2005).

One recent change matters for anyone who checked numbers by hand: MCMC's public MNP Check website was discontinued with effect from 8 May 2026 (MCMC notice). For automated routing, you need a lookup through a provider instead.

Our MNP atlas has no verified row for Malaysia yet.

For routing, SMS cost or fraud rules, look up the current network per number instead of reading the prefix. Our MNP lookup returns ported or not_ported and the current MCC/MNC, and our MNP atlas compares porting rules across countries.

#What do prepaid SIM registration rules mean for validation?

Every prepaid line in Malaysia must be registered to an identity document, and the rules tightened in 2026. On 26 February 2026 MCMC registered the Commission Determination on the Mandatory Standard for the Registration of End Users of Public Cellular Prepaid Services. As Bernama reported, it caps prepaid SIMs at five per person per operator for citizens and permanent residents and two for non-citizens, uses biometric checks and MyDigital ID for self-registration, bars registration of children under 12, and ends tourist SIMs after at most three months (Bernama, 2026).

Two consequences for number data:

• Tourist numbers expire. A Malaysian number collected from a visitor can stop working within three months. Recheck it before an important message instead of trusting an old "valid" flag; our guide on how long check results stay valid covers refresh intervals.
• Registration isn't identity for you. The identity behind a line stays with the operator. No lawful lookup, ours included, returns the registered name or ID number.

#What are the rules for SMS and marketing messages?

These summarise MCMC and statutory sources as we read them on 2026-10-14. Not legal advice; ask counsel how they apply to you.

#Links and phone numbers in SMS are blocked

On MCMC's direction, operators began blocking SMS containing links sent from mobile numbers on 2 May 2023, with business short codes to follow after notice (MCMC press clipping, 2023). CelcomDigi's customer notice says SMS containing URL links, personal details or phone numbers are blocked, that the rule covers person-to-person and application-to-person traffic, and that MCMC's short-code exemption was revoked from 1 September 2024. Blocked messages can't be unblocked (CelcomDigi).

For OTP and service SMS, that means plain text: the code, your brand and an instruction, no link and no callback number. A delivery report may still show "sent" for a blocked message, so measure conversion as well; see why SMS is not delivered.

#Section 233A and the proposed anti-spam framework

The Communications and Multimedia (Amendment) Act, gazetted in February 2025, inserted section 233A into the Communications and Multimedia Act 1998, which prohibits sending unsolicited commercial electronic messages. MCMC's consultation paper of 13 August 2025 proposed the regulations that would apply it (MCMC, 2025):

When we checked on 2026-10-14, we couldn't confirm from official sources that these regulations or section 233A are in force. Treat the table as the direction of travel. Its consent and opt-out rules are already good practice, and the ban on generated addresses is one reason we refuse requests that look like number-range scans.

#The PDPA 2010 and its 2024 amendments

A Malaysian mobile number linked to a customer is personal data under the Personal Data Protection Act 2010 (Act 709). Section 43 lets a person require you, by written notice, to stop processing their data for direct marketing, defined as advertising or marketing material "directed to particular individuals" by any means (JPDP, Act 709). The Personal Data Protection (Amendment) Act 2024 came into force in stages: 1 January, 1 April and 1 June 2025. It renamed data users "data controllers", raised the maximum fine for breaching the data protection principles to RM1,000,000, extended the security principle to data processors and, from 1 June 2025, added mandatory breach notification, a data protection officer and a right to data portability (Norton Rose Fulbright, 2025).

#Can I check if a Malaysian number is on WhatsApp?

Yes, for numbers your customers gave you, with a stated purpose. Our WhatsApp number check answers registered, not registered or unknown, with a checked_at time. It doesn't read profiles, names or photos, and a registered result is not permission to message anyone.

Businesses check Malaysian numbers mainly to choose a support or OTP channel. Meta prices Malaysia as its own WhatsApp market, lists Malaysia among the markets with an authentication-international rate for eligible businesses sending codes from abroad, and added the ringgit (MYR) as a billing currency from 1 April 2026 (Meta pricing, read on 2026-10-14). If you send OTPs to Malaysia from another country at volume, compare both rates with SMS; our WhatsApp OTP vs SMS OTP post shows how.

What a lawful check looks like under the PDPA, in our reading:

Our consent and law guide compares Malaysia's PDPA with the GDPR, India and Brazil in detail. Requests with 20 or more consecutive numbers are refused with 403 suspected_enumeration, and our acceptable use policy forbids finding recipients for unsolicited messages. People can object through our opt-out form.

Here is the check from code, after normalize_my(). It uses the public sandbox key mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym and our test values, which are UK drama numbers because the sandbox accepts only those. With a live key, pass the output of normalize_my(). We ran it on 2026-10-14 with Python 3.12 and requests 2.34.

import os

import requests  # pip install requests

API = "https://api.mobilevalidate.com/v1/lookup"
KEY = os.environ["MOBILEVALIDATE_API_KEY"]


def channel_facts(numbers: list[str]) -> dict[str, dict]:
    """Porting status and WhatsApp registration for numbers your customers gave you."""
    r = requests.post(API, headers={"Authorization": f"Bearer {KEY}"}, timeout=15,
                      json={"numbers": numbers, "checks": ["mnp", "whatsapp"], "wait": 5})
    r.raise_for_status()
    out = {}
    for row in r.json()["results"]:
        mnp, wa = row["checks"]["number.mnp"], row["checks"]["whatsapp.registered"]
        out[row["e164"]] = {
            "porting": (mnp["attributes"] or {}).get("porting"),  # ported, not_ported or None
            "whatsapp": wa["registered"] if wa["status"] == "completed" else None,  # None = unknown
            "checked_at": wa["checked_at"],
            "billed": mnp["billed"] or wa["billed"],
        }
    return out


for number, info in channel_facts(["+447700900001", "+447700900002", "+447700900005", "+447700900006"]).items():
    print(number, info)

+447700900005 stands for a country a check doesn't cover: it answers unsupported_country, which the script maps to None, never to False. Test mode never bills; in live mode, unknown and unsupported answers aren't billed either. For a whole customer file, a bulk job takes up to 50,000 numbers, and the free estimate (POST /v1/jobs/estimate) shows the maximum cost before you start; see our bulk WhatsApp check guide.

#What changed recently?

The rows for MY and +60 in our numbering-plan changes dataset, built from libphonenumber's release notes:

Latest numbering-plan updates for MY: 2026-04-22 (v9.0.29), 2026-03-26 (v9.0.27), 2026-02-25 (v9.0.25), 2025-05-23 (v9.0.6), 2024-07-24 (v8.13.42).

Malaysia's metadata changes often: three updates in the first four months of 2026 alone. Update your validation library at least monthly, or numbers from newly opened sub-blocks will fail. On the rules side, the recent changes are the 2026 prepaid registration standard, the end of MCMC's MNP Check website, and the PDPA amendments that took full effect in June 2025.

#What can MobileValidate check for Malaysian numbers?

Generated from our public catalog:

* bulk jobs only. Catalog as fetched on 2026-10-14; the live list is at GET /v1/services.

A lookup returns network and registration facts. It never returns a subscriber's name, MyKad number or address, and we don't offer "number details" searches. See MNP lookup, HLR lookup and WhatsApp number check for the fields, our channel selection use case for routing, and pricing for current prices.

#What are the key takeaways?

• Malaysian mobiles are +60 1 plus eight or nine digits: 01X-XXX XXXX at home, 011-XXXX XXXX for the longer 011 range. Store the E.164 form.
• Don't validate with a fixed length or a shape regex: 015 holds VoIP ranges, and several blocks are only partly mobile.
• The prefix shows the original operator. Porting has existed since October 2008, and MCMC's public MNP Check site closed in May 2026, so look up the current network when it matters.
• SMS with links or phone numbers are blocked; keep OTPs plain. Section 233A's anti-spam rules are proposed, and the PDPA already applies.
• A WhatsApp check is for your own customers' numbers, with a stated purpose. Registration isn't consent, and no lawful lookup returns who owns a number.

Platform, regulator and company names are used descriptively. MobileValidate is not affiliated with any of them.