You need a referral from someone already inside
When Malaysia moved to ban the online sale of vaping products in 2026, it discovered an enduring truth of prohibition: markets do not disappear, they migrate. The trade retreated into encrypted, invite-only digital spaces where referrals replace receipts and anonymity replaces accountability. What began as a public health measure has become a test of whether modern governance can keep pace with the speed and ingenuity of underground commerce.
- Products exceeding ten times the legal puff limit and carrying banned flavors are openly available — but only to those with the right connections inside closed digital networks.
- Sellers have abandoned websites entirely, retreating into Telegram groups and WhatsApp channels that render conventional enforcement tools like site-blocking almost meaningless.
- Financial trails dissolve into networks of mule accounts and fragmented e-wallet transactions, turning investigations into labyrinths with no clear exit.
- Cybersecurity experts argue that authorities can still act — combining undercover access, metadata, device seizures, and payment records — but the effort demands coordination that current systems struggle to provide.
- Calls are growing for stiffer penalties, public tip-off rewards, and cross-border cooperation with platform companies, even as the Health Ministry has yet to respond.
Malaysia's 2026 ban on online vape sales did not end the market — it drove it underground. Today, buying a vape in Kuala Lumpur requires not a credit card but a referral: a voucher from someone already inside a closed, encrypted network. The Control of Smoking Products for Public Health Act set firm limits on devices and banned certain flavors, but the law's reach stops at the edge of the open internet.
While authorities successfully pressured mainstream platforms like Shopee and Lazada to remove listings, they found themselves powerless against invite-only digital marketplaces functioning like modern speakeasies. Applicants submit referrals, administrators verify identities, and approved buyers gain access to catalogues offering devices with up to 32,000 puffs — more than ten times the legal ceiling — alongside hundreds of banned products invisible to anyone without prior approval.
Cybersecurity professionals describe the shift as a fundamental change in how illicit commerce operates. Sellers have abandoned dedicated websites in favor of encrypted messaging platforms, making site-blocking an exercise in futility — shut one down, and another appears within days. Financial trails are equally elusive, typically dissolving into mule accounts rather than leading to the syndicates behind them.
Yet experts caution against fatalism. Investigations need not rely on reading encrypted messages; undercover access, device seizures, account attribution, and licensed payment records can together build prosecutable cases. The true obstacle is fragmentation — money and identity scattered across dozens of intermediaries, making the full picture nearly impossible to assemble quickly.
What emerges is a widening gap between the pace of regulation and the adaptability of underground networks. Experts are urging transparent reporting mechanisms, financial incentives for tip-offs, harsher penalties — especially for those targeting minors — and genuine cross-border cooperation with platform companies. Whether Malaysia's enforcement architecture, built for an earlier era of commerce, can evolve fast enough remains the open and urgent question.
Malaysia banned the online sale of vaping products in 2026, but the market did not vanish. It simply went underground, transforming into a network of encrypted, invite-only platforms that operate entirely beyond the reach of regulators. To buy a vape today in Kuala Lumpur, a credit card is no longer sufficient. You need a referral from someone already inside.
The Control of Smoking Products for Public Health Act, known as Act 852, set strict limits on vaping devices—capping them at 3,000 puffs per unit and banning certain flavors and packaging. The law was designed to protect public health. But enforcement has proven far more difficult than lawmakers anticipated. While authorities successfully pressured mainstream e-commerce platforms like Shopee and Lazada to remove vape listings, they discovered they had little power over closed-loop networks operating through encrypted channels.
These underground marketplaces function as digital speakeasies. A prospective buyer submits an application and provides the name of an existing customer who can vouch for them. An administrator verifies the referrer's identity before granting access to the full product catalogue. Once inside, buyers can purchase vapes with as much as 32,000 puffs per device—more than ten times the legal limit. Hundreds of products in banned flavors and packaging are available for immediate purchase, all invisible to casual browsers and inaccessible without prior approval.
The sophistication of these operations has caught cybersecurity experts off guard. Fong Choong Fook, chief executive of the cybersecurity firm LGMS, explained that sellers have largely abandoned traditional websites altogether. They now operate through forums, chat groups, and encrypted messaging platforms like Telegram and WhatsApp. Having a dedicated website is no longer common practice. This shift renders conventional enforcement methods—blocking websites, for instance—almost useless. Even when authorities manage to shut down a site, sellers can simply spawn a new one within days. The real problem, Fong warned, is that blocking websites amounts to treating a symptom rather than addressing the underlying disease.
The challenge becomes exponentially harder when sellers move to encrypted platforms. Telegram groups and WhatsApp channels selling contraband are extremely difficult to abolish because doing so requires cooperation from the social media companies themselves—a process that involves complex legal jurisdictions, cross-border agreements, and considerable time. Investigators can sometimes trace the financial trail through e-wallets like Touch 'n Go or direct bank transfers, but the path typically leads to mule accounts—intermediaries who handle money on behalf of the actual sellers—rather than to the syndicate operators themselves. Following the money becomes a labyrinth of dead ends.
M. Selvakumar, director of the Cybersecurity Research Centre at Universiti Sains Malaysia, offered a more measured assessment. While difficult, he said, it is not impossible for Malaysian authorities to act against these networks. End-to-end encryption does reduce visibility into message content, but investigations rarely depend solely on reading messages. Authorities can combine complaints, undercover access, device seizures, account attribution, metadata obtained through lawful process, and financial investigation to build cases. E-wallet and QR transactions are generally more traceable than they appear, since licensed payment providers maintain records and apply anti-money-laundering controls. The real challenge is not invisibility but fragmentation—payments spread across multiple wallets, mule accounts, and intermediaries, making it difficult to see the full picture.
Experts have called for systemic change. Fong advocated for a more transparent public reporting mechanism, including financial rewards for tip-offs, and stressed that lawmakers must introduce stiffer penalties, particularly to deter sellers from targeting minors online. The Health Ministry, when contacted for comment, did not respond. As the underground vape trade continues to evolve and migrate across platforms, the gap between regulation and reality widens. The question facing Malaysian authorities is whether traditional enforcement tools—designed for a different era of commerce—can adapt quickly enough to keep pace with networks that can be rebuilt in days and operate across borders with ease.
Citas Notables
It is difficult to police because they don't even need to set up websites anymore. They operate over forums, chat groups, and Telegram groups.— Fong Choong Fook, CEO of cybersecurity firm LGMS
The main challenge is not invisibility but fragmentation as payments may spread across multiple wallets, mule accounts, and intermediaries.— M. Selvakumar, director of Universiti Sains Malaysia Cybersecurity Research Centre
La Conversación del Hearth Otra perspectiva de la historia
Why did the ban actually make things worse instead of better?
The ban itself was sound policy—it set reasonable limits on nicotine delivery and banned marketing tactics aimed at young people. But it assumed sellers would obey. What happened instead is that legitimate sellers simply moved to platforms the government couldn't easily see or control. The ban created the conditions for a black market to flourish.
So these underground platforms—how do they actually stay hidden?
They're not hidden in the way you might think. They're not on the dark web or anything exotic. They operate on regular apps like Telegram and WhatsApp, but they're closed communities. You can't find them by searching. You need someone already inside to vouch for you. It's like a club with a membership requirement.
And the products they're selling—are they dangerous?
That's the real concern. A device with 32,000 puffs is delivering far more nicotine than the 3,000-puff limit allows. For young people especially, that's a significant health risk. The ban was trying to prevent exactly this kind of high-concentration product from reaching the market.
Why can't the government just shut down these Telegram groups?
Because Telegram is encrypted and operates globally. To shut down a group, you'd need Telegram's cooperation, which requires going through legal channels in multiple countries. By the time you've done all that, the sellers have already created five new groups. It's like trying to catch water with your hands.
Is there any way to actually stop this?
Possibly, but it requires rethinking enforcement entirely. You can't win by blocking websites or chasing individual groups. You need to follow the money more aggressively, offer rewards for information, and impose real consequences on sellers—especially those targeting minors. You also need international cooperation. But that takes time and coordination that most governments struggle to achieve.
So the ban failed?
Not entirely. It did push the market underground, which means fewer casual buyers and less mainstream visibility. But it also created a more sophisticated, harder-to-police market. Whether that's a net win or loss depends on how you measure it.