UPDATE — 2026-05-08
After thorough investigation and gathering first-hand accounts from past users, we can confirm that onlinepaip was originally a legitimate website — previous users had paid successfully via FPX (Malaysia's regulated online banking gateway). The site now requires manual transfers via DuitNow or TNG eWallet to a personal bank account — a strong indicator the platform has been compromised and replaced with a scammer's payment details.
onlinepaip.com is not the official PAIP Berhad site. Scammers are running a fake PAIP Berhad portal that tricks Pahang residents into paying water bills into a private account — while harvesting their personal data on the way.
What's happening
Recently, our community flagged a website — onlinepaip.com — pretending to be the official online portal for PAIP Berhad (Pengurusan Air Pahang Berhad), the state water utility for Pahang.
The site looks polished. It has a login page, a registration form, a password-recovery flow, and pages titled "Privasi", "Penafian", and "Keselamatan". On first glance it could pass for a legitimate billing portal.
PAIP Berhad has disclaimed this domain
PAIP Berhad has publicly stated that this site is not affiliated with them in any way. See their official Facebook post for the disclaimer.
How the scam works
1. Victim searches "bayar bil air Pahang online" on Google, or clicks a link from a phishing SMS / WhatsApp message.
2. Lands on onlinepaip.com, which mimics a real water-utility portal.
3. Registers an account — handing over their full name, IC number, phone number, and email.
4. Tries to "pay" their water bill — and the site instructs them to bank-transfer the amount to a personal individual bank account, not the official PAIP Berhad corporate account.
5. Money disappears. The bill is never paid, and the operator now also has the victim's personal data — useful for further scams (loan fraud, impersonation, social engineering against family).
5 red flags you can spot in 10 seconds
1. The URL is wrong — but only slightly, on purpose. The real PAIP Berhad website is paip.com.my. The scam site is onlinepaip.com — added the word "online" in front, and dropped the .my. It's deliberately designed to look like an "online billing portal" version of the real domain, exploiting your instinct to trust anything containing "paip". When in doubt, type paip.com.my directly into your browser. Never click search-result links for utility payments.
2. Site asks for too much personal info up front. Real billing portals only need your account number to look up your bill. If signup demands your IC, address, phone, AND email before you've even seen a bill, that's data harvesting, not service.
3. No input validation on signup. The registration form accepts "123" as a valid IC number — anything goes. Any real Malaysian portal validates IC against the standard format (12 digits, YYMMDD-PB-####, with a check). The fake site doesn't bother because it isn't actually looking up your account against PAIP Berhad's customer database. It's just collecting whatever you type into a form and storing it raw.
4. No JomPAY biller code, no PahangGO, no e-wallet options. The real PAIP Berhad accepts payments through JomPAY (biller code 51987), the official PahangGO app, e-wallets (Boost, Touch 'n Go, Shopee), banks (Agrobank, Bank Rakyat, BSN), POS Malaysia, 7-Eleven, KK Super Mart, and BHP / Petronas / Petron stations. The fake site offers none of these — only a direct bank transfer to a personal account. That's because scammers can't legally register a JomPAY biller, can't onboard with a state government app, and can't run e-wallet integrations. They have nothing else to offer.
5. Payment goes to a personal bank account. No matter how polished the page looks, the "pay now" step asks you to bank in to an individual person's name. Real utility companies in Malaysia never accept payment into a personal account — every payment goes to the company or through approved channels. If the transfer screen shows "Leonardi Calven" instead of "PAIP Berhad", stop immediately. That alone is enough proof of fraud.
The single biggest red flag
If you are asked to pay your water bill into a personal bank account in someone's name, stop. That alone is enough to know it's a scam — no legitimate state utility ever asks for that.
If you have already paid them
You are not alone, and you are not at fault — these scams are deliberately polished to fool careful people. Act fast:
1. Call your bank immediately — request a freeze / recall on the transfer. The faster you act (ideally within 24 hours), the better the chance of recovery.
2. Lodge a police report at your nearest station. Bring screenshots of the website, the receipt of your transfer, and any WhatsApp / SMS messages that led you to the site.
3. Report to the National Scam Response Centre (NSRC): dial 997.
4. Report to PAIP Berhad through their official Facebook page so they can update their disclaimer and warn other customers.
5. Submit the case to PenipuMY so you'll help others avoid the same trap.
Stay safe out there
When something asks you to pay into someone's personal bank account in the name of a government service, the answer is always no. If you spot another suspicious "bayar bil" site, report it on penipu.my — the faster the community knows, the fewer victims.