Vape business in Malaysia thrives underground after online ban

KUALA LUMPUR – To buy a vape online in Malaysia today, a credit card is no longer enough. You need a referral.

Despite a sweeping nationwide ban on the online sale of e-cigarettes and vaping products under the Control of Smoking Products for Public Health Act (Act 852), the market has not disappeared.

Instead, it has morphed into an underground network of digital speakeasies – invite-only e-commerce platforms that operate entirely out of the view of regulators.

To access one of a growing number of underground vape stores operating in Malaysia, a prospective buyer must first obtain a referral from an existing customer.

The application is then reviewed by an administrator, who verifies the referrer’s identity before approving a profile and granting access to the platform’s full catalogue of vaping products – many of which fall outside the country’s regulatory framework.

The platforms, which are invisible to casual browsers and inaccessible without prior vetting, are selling vapes with as many as 32,000 puffs per device. This is well above the regulations, which cap the puff limit at 3,000 due to capacity limits under Act 852.

Hundreds of vape devices, pods and e-liquids – many in flavours and packaging explicitly banned under the new regulations – were available for immediate purchase.

While the authorities have successfully pressured public platforms such as Shopee and Lazada to scrub vape listings, they are largely powerless against closed-loop, encrypted networks.

Cybersecurity experts warn that traditional enforcement methods, such as blocking websites, are largely ineffective against this new wave of digital black markets.

Experts who examined the model say the illicit vape trade has grown far more sophisticated than most people realise.

Chief executive Fong Choong Fook of cybersecurity company LGMS said sellers have long since moved past conventional e-commerce.

“It is difficult to police because they don’t even need to set up websites anymore. They operate over forums, chat groups and Telegram groups. In fact, having a dedicated website is no longer common – they typically operate under social media chat groups,” he said.

While the Malaysian Communications and Multimedia Commission has the technical capability to block illicit websites, Mr Fong warned that this amounted to little more than a temporary fix.

“Technically, it is very easy to block a website. The only problem is that they can spawn a new site every now and then, so it doesn’t solve the problem from the root,” he said.

The challenge deepens significantly when sellers migrate to encrypted platforms.

“If they are operating groups on Telegram or WhatsApp, it is very hard to take action. I have seen Telegram groups selling contraband and smuggled goods.

“These groups are difficult to abolish because it requires cooperation from the social media platform providers to help block them. This takes a long time and involves complex processes and cross-border legal jurisdictions,” Mr Fong explained.

Tracking the financial trail of these operations is possible, but rarely conclusive.

Mr Fong said if sellers rely on e-wallets such as Touch ‘n Go or direct bank transfers, there are avenues for investigators to pursue – though the trail often hits a wall.

“You will very likely trace it back to a mule account, not the actual seller. One thing leads to another, and the authorities have to investigate the mules to even­tually lead them back to the actual syndicate,” he said.

Mr Fong called for a more transpa­rent public reporting mechanism, including financial rewards for tip-offs, and stressed that lawma­kers must introduce stiffer penalties, particularly to deter sellers from targeting minors online.

Universiti Sains Malaysia Cybersecurity Research Centre director M. Selvakumar said it is difficult but not impossible for the Malaysian authorities to act against invite-only social media communities selling unregu­lated vape products.

“End-to-end encryption redu­ces visibility into message content, but investigations rarely depend only on reading messa­ges.

“The authorities typically combine complaints, undercover access, device seizures, account attribution, (and) metadata obtained through lawful process and financial investigation.”

The speed and scale at which groups can be recreated rapidly and move across channels are among the operational challenges, Dr Selvakumar said.

He added that e-wallet and QR transactions are generally more traceable than they appear.

“Licensed payment providers maintain transaction records and apply anti-money-laundering con­trols, so even small payments can contribute to an investigative trail,” he said.

“The main challenge is not invisibility but fragmentation as payments may spread across multiple wallets, mule accounts and intermediaries.” THE STAR/ASIA NEWS NETWORK