Can You Put a Link in an SMS in Malaysia? What Businesses Need to Know.

For a business planning ordinary SMS delivery in Malaysia, the safe starting point is to leave hyperlinks out. MCMC’s notice dated 1 September 2024 identifies hyperlinks, requests for personal information and callback numbers as prohibited content in SMS. This is a content restriction, not simply a recommendation to avoid unfamiliar websites. ^[1]

That distinction changes how a message should be designed. If the customer journey depends on tapping a URL, rewrite the journey before scheduling the campaign. Do not buy SMS credits first and assume a branded domain or a shorter link will make the content acceptable.

What the published guidance says

MCMC explains that the restrictions are intended to reduce SMS-based fraud and impersonation. Its notice also explains how recipients can report messages that still contain the prohibited content. ^[1] The practical consequence for legitimate businesses is that familiar marketing techniques may not be suitable for SMS.

Maxis’s business FAQ explicitly includes shortened URLs and fixed or mobile numbers among the blocked content, and states that earlier essential-service exemptions ended on 31 August 2024. ^[2] CelcomDigi also states that the short-code exemption was revoked from 1 September 2024. ^[3]

Do not infer an exemption from the fact that your organisation is reputable, your domain uses HTTPS, or you have previously sent a similar message. Have the provider review the actual proposed content and destination requirements before launch. The sources linked below are the basis for this guide; confirm requirements again when planning a campaign.

Does a short link solve the problem?

No: shortening a URL does not remove its purpose as a link. A shortener can make a message visually compact, but it is not a compliance strategy. Maxis expressly refers to shortened URLs in its explanation of prohibited SMS content. ^[2]

Do not try to evade filtering with spaces, unusual punctuation, QR-code references or instructions to reconstruct a web address. Those techniques can undermine customer trust and create an unreliable journey. The appropriate response is to choose a permitted communication design or a different channel.

Similarly, avoid testing many disguised versions against live customers to discover which one passes. A message passing through once does not establish that it is permitted or that it will be delivered consistently. Content review should come before a live send.

What about callback numbers and personal information?

Review the whole message, not only its URL. A request to call a number or supply personal details can create a separate issue even after a hyperlink has been removed. Do not replace “click here” with a telephone number and assume the original problem has disappeared.

Distinguish a verification code from a request for personal information. An OTP message can tell a customer the code for an action they initiated; it should not ask them to send back banking credentials, identity details or the OTP itself. The exact wording should be reviewed within the intended workflow.

Keep sensitive account details out of general notifications wherever possible. A notice can explain that an update is available without reproducing everything in a text message. This also reduces the consequences of a message reaching an old or incorrectly entered number.

Rewrite the next step, not just the sentence

A strong link-free SMS gives the recipient a clear action that does not depend on a clickable address. For an existing customer, that may mean opening the official app they already use and checking a named area. Avoid vague instructions such as “check now” without saying what has changed.

For example: “Your order status has been updated. Open our official app and check My Orders for the latest details.” This is an editorial example for discussion, not an approved template. Add an appropriate sender identity and ask your provider to review the complete version.

For a school, the next step might be to consult an established parent portal through the usual route. For an appointment reminder, the message may contain the date, time and location so no link is needed. Choose the action the recipient already understands.

Three example rewrites to discuss with your provider

An order message that originally depended on a tracking URL could become: “Your parcel is on its way. Open our official app and check your order for delivery updates.” Make sure that the promised app information actually exists before using the copy.

An appointment message could become: “Reminder: your appointment is tomorrow at 10 AM at our usual branch. Please arrive 10 minutes early.” Use the real location when required, and avoid sending a vague branch reference to a customer who visits more than one site.

An account notice could become: “A new statement is available. Sign in through your usual official app to review it.” Do not include a balance or other sensitive detail merely to make the message feel personalised. These examples illustrate a writing approach; delivery and content approval still need checking.

When WhatsApp may fit better

If the purpose requires rich content, buttons or a two-way conversation, discuss WhatsApp Business API with Globe. Globe lists WhatsApp Business API alongside its business SMS and API services. ^[4] Channel choice should follow the customer journey, not a desire to bypass SMS filtering.

WhatsApp is not an unrestricted substitute. Confirm business onboarding, recipient permissions, applicable template requirements and the costs for the proposed workflow. Do not automatically move every SMS recipient into a different messaging programme without reviewing that relationship and the channel’s requirements.

Keep a plain SMS notification for a simple, time-sensitive update when it fits. Use a richer channel when the customer needs to inspect content, ask a question or complete a longer interaction. Different stages of the same service journey may need different channels.

Put a review process around campaigns

Create a pre-send checklist covering destination, message purpose, sender setup and the complete content. Search for web addresses, shortened links, telephone numbers and requests for personal details. Review dynamic fields too: a template without a URL can still receive one through a variable.

Give someone responsibility for final approval and keep the approved version. If a campaign is blocked, collect the message content, time and delivery information for the provider. Avoid repeated blind resubmissions. Resolve the reason before trying again.

Test the revised customer journey end to end. A link-free message is not useful if the app does not contain the promised update or staff cannot explain what the customer should do. Operational readiness matters as much as wording.

What to ask Globe before sending

Share your intended audience, sample message and desired customer action. Ask which channel fits, what sender setup is needed and how to interpret the delivery outcome. Be explicit if your original design included a link or callback number so the alternative can be considered early.

The objective is a message customers recognise and can act on safely. For Malaysia, build SMS around a clear notification and a familiar independent next step. Use the provider’s review and current operator guidance to validate the final implementation.