Everyday money
Personal data leaked or misused in Indonesia: what to do if someone uses your NIK or KTP photo
What to do if your NIK or KTP photo leaks or is used for a loan in your name: check SLIK, complain to OJK, report to police and use your PDP Law rights.
English edition. Official forms and source documents may be in Indonesian.
QUICK ANSWER
What should I do if my NIK or KTP photo has leaked or been used for someone else’s online loan?
If your NIK (national identity number) or KTP photo has leaked or is being used by someone else, gather evidence, check your OJK iDeb SLIK credit report to see any credit recorded in your name, then complain about loans you never applied for to the lender and to Kontak OJK 157 or APPK at kontak157.ojk.go.id. Make a police report and use your rights under Law 27/2022 on Personal Data Protection to request access to, correction of and deletion of your data. As of 14 October 2026 we had not found the legal basis establishing the data protection supervisory body that the law requires.
See 9 official references ↓Complain to OJK through Kontak 157 and APPK ↗kontak157.ojk.go.id
Guide contents
What to have ready
- Screenshots of collection messages, the collector’s number, the app or company name and the date you were first contacted.
- Proof of any money paid into your account, such as a bank statement or transfer notification.
- A recent OJK iDeb SLIK report in your name.
- A short timeline: when and where you have ever handed over or uploaded a KTP photo, a selfie with your KTP, or your NIK.
- Your original KTP-el (electronic identity card) for the police report and identity checks on official channels.
Steps to deal with data misuse
Gather evidence and stay calm
Keep all messages, collectors’ numbers, app names and proof of transfer. Do not pay for a loan you never applied for just because you are threatened, and do not give any more data to collectors.
Do not use money that suddenly arrives
The task force against illegal financial activity advises not using "wrong transfer" money sent by illegal online lenders. Report it to your bank and ask for the funds to be held until it is clear who is responsible.
Check credit in your name on SLIK
Request your OJK iDeb SLIK report at idebku.ojk.go.id to see credit facilities reported in your name. Note the name of any institution and credit account number you do not recognise.
Complain to the lender, then to OJK
Send a written complaint through the lender’s official channel: state that you never applied for the loan, ask for a copy of the application data and ask them to stop processing your data. If it is not resolved, complain to Kontak OJK 157, WhatsApp 081 157 157 157 or APPK at kontak157.ojk.go.id. Report illegal lenders at sipasti.ojk.go.id.
Make a police report
The Directorate General of Population and Civil Registration (Dukcapil) asks anyone who learns of a data leak to report it to the authorities straight away. Take your timeline, evidence and KTP-el to a police station, and keep the report receipt to answer collectors and support later complaints.
Secure your accounts and prevent further misuse
Change the passwords for your email, mobile banking and social media, and never give your OTP to anyone. Delete any posts showing your KTP or KK (family card). Watch out for follow-up messages offering to "whitewash" your data or clear bills for a fee.
Cost of complaining and requesting your data
Free. Requesting an iDeb SLIK report at idebku.ojk.go.id, complaining to Kontak OJK 157, APPK and SIPASTI, and making a police report cost nothing. According to the elucidation of Article 7 of the PDP Law, a copy of your personal data from a data controller is free, except in certain circumstances that genuinely require a fee.
| Problem | Where to go | Notes |
|---|---|---|
| A licensed online lender records a loan you never applied for | The lender’s official complaint channel, then Kontak OJK 157 or APPK | Keep the ticket number from the lender |
| An illegal lender is chasing you or money suddenly arrives in your account | sipasti.ojk.go.id and your bank | Do not use the money; ask the bank to hold it |
| Unknown credit appears on your iDeb SLIK report | The reporting institution named in the iDeb, then Kontak OJK 157 | Attach the iDeb and police report |
| Your account was hacked or you were tricked into transferring money | Your bank and iasc.ojk.go.id | Report as quickly as possible |
| Your KTP photo or NIK is being shared or used to defraud | The police | Bring screenshots and a timeline |
| You want to know what data a company holds about you | The personal data controller (that company or app) | Right of access and a copy, Articles 7 and 32 of the PDP Law |
OJK states it has never issued any statement about "whitewashing" online loan data. Anyone offering in OJK’s name to erase bills or repair credit scores for a fee is a scammer.
Your rights under the Personal Data Protection Law
Law 27/2022 on Personal Data Protection (the PDP Law) was enacted on 17 October 2022, and anyone processing personal data had to comply within 2 years of its promulgation. Under the law you are the data subject, and the company or body that decides why data is processed is the personal data controller.
Your rights include: information about the identity and purpose of whoever asks for your data (Article 5); completing, updating or correcting wrong data (Article 6); access to and a copy of data about you (Article 7); ending processing and deleting or destroying data (Article 8); withdrawing consent (Article 9); and suing for compensation for breaches in the processing of your data (Article 12).
A data controller must give access within 3 x 24 hours of receiving a request (Article 32), correct data within 3 x 24 hours (Article 30) and stop processing within 3 x 24 hours after consent is withdrawn (Article 40). The controller must also delete data obtained or processed unlawfully (Article 43). If data protection fails, the controller must notify data subjects in writing within 3 x 24 hours (Article 46).
Article 65(3) prohibits anyone from unlawfully using personal data that does not belong to them, and Article 67 sets out the criminal penalties.
Status of the PDP supervisory body
Article 58 of the PDP Law states that personal data protection is carried out by a body established by the President, accountable to the President and governed further by a Presidential Regulation. Under Articles 59 and 60, this body supervises data controllers’ compliance, imposes administrative sanctions, facilitates out-of-court dispute settlement and receives complaints and reports of suspected breaches.
As of 14 October 2026 we had not found a Presidential Regulation establishing this body in the official regulation databases. That means there is no dedicated PDP-body complaint channel we can point you to yet. In the meantime, use your rights directly with the data controller, the relevant sector’s complaint channel (for example OJK for financial institutions) and the police for suspected crimes. This guide will be updated once the body is set up.
If there is an online loan in your name
OJK offers several routes. For licensed lenders, complain first through the company’s official complaint channel, then to Kontak OJK 157, WhatsApp 081 157 157 157, email konsumen@ojk.go.id or the Consumer Protection Portal (APPK) at kontak157.ojk.go.id if it is not resolved. For illegal lenders, use SIPASTI; its homepage specifically invites people who find money suddenly paid into their account by an unlicensed online lender to make a complaint.
For the "wrong transfer" trick, the task force advises: do not use the money, keep evidence and report it to the police, report it to your bank and ask for the funds to be held, and tell the collector that you never applied for a loan and have not used the money. You may block the collector’s number if needed.
Also check your iDeb SLIK, your credit record in OJK’s Financial Information Service System, to see credit reported in your name. The iDeb report and police report are useful attachments to a complaint.
Preventing the next leak
Dukcapil asks people not to upload scans of their KTP or KK to social media and not to post selfies holding their KTP. If you must hand over a copy or photo of your KTP, give it only to an official party with a clear purpose; Article 5 of the PDP Law gives you the right to ask about the identity, legal basis and purpose of whoever requests your data.
Dukcapil also states that it does not provide any website or app for checking a NIK. Sites or accounts claiming to "check your NIK" risk misusing the data you enter. For population records, visit your local Dukcapil office or use official apps such as IKD (the digital identity app).
Things to check carefully
- Paying an online loan you never applied for because you are afraid of threats, without complaining or reporting to the police.
- Spending money that suddenly arrives from an illegal lender. The task force advises not using it and asking your bank to hold it.
- Paying for a service to "whitewash" online loan data or repair your SLIK score. OJK says it has never issued any statement about whitewashing loan data.
- Checking your NIK on websites or social media accounts claiming to look up population data. Dukcapil provides no such channel.
- Posting your KTP, KK or bills showing your NIK on social media to ask strangers for help.
Frequently asked questions
What should I do if there is an online loan in my name that I never took out?
Gather evidence and complain in writing through the lender’s official channel, then to Kontak OJK 157 or APPK at kontak157.ojk.go.id if it is not resolved. If the lender is illegal, report it at sipasti.ojk.go.id. Also make a police report and check your iDeb SLIK.
Money from an online lender suddenly arrived in my account. What should I do?
Do not use it. The task force advises keeping evidence, reporting to the police, reporting to your bank and asking for the funds to be held, and telling the collector that you never applied for a loan. SIPASTI accepts complaints about money received from unlicensed lenders.
How can I check whether there are loans in my name?
Request your OJK iDeb SLIK report at idebku.ojk.go.id. The iDeb shows credit facilities reported in your name by reporting institutions. If there is credit you do not recognise, complain to the institution listed and to Kontak OJK 157.
What are my rights over my personal data under the PDP Law?
You have the right to information about who is asking for your data, to correct it, to access it and get a copy, to end processing, to have it deleted or destroyed, to withdraw consent and to sue for compensation for breaches. These rights are set out in Articles 5 to 12 of Law 27/2022.
How quickly must a company respond to my request to access my data?
Within 3 x 24 hours of receiving the request, under Article 32(2) of the PDP Law. The same limit applies to correcting data (Article 30) and to stopping processing after consent is withdrawn (Article 40).
Has the personal data protection supervisory body been set up?
We have not found it. The PDP Law requires a body established by the President and governed by a Presidential Regulation, but as of 14 October 2026 we had not found that Presidential Regulation in the official regulation databases. In the meantime, use your rights directly with the data controller, sector complaint channels and the police.
Can a KTP photo that has already spread be taken back?
Not completely. You can ask the data controller holding it to delete data processed unlawfully (Article 43 of the PDP Law) and report its sharing or use to the police. Most importantly, check your iDeb SLIK and financial accounts regularly.
Is there an official website to check whether my NIK has leaked?
Not from Dukcapil. Dukcapil states it provides no website or app for checking a NIK and asks people not to verify their NIK on unclear sites. For population records, visit your local Dukcapil office.
Sources and review
Editorial review of public information: . This is not a review by an agency officer or a professional adviser. Reviewed by Kaiser Khan, publisher of Panduan Warga. Official document titles are retained below.
- JDIH BPK: UU 27/2022 tentang Pelindungan Data Pribadi ↗peraturan.bpk.go.id · Accessed 14 October 2026
- OJK: Kontak 157 dan Aplikasi Portal Perlindungan Konsumen (APPK) ↗kontak157.ojk.go.id · Accessed 14 October 2026
- OJK: SIPASTI ↗sipasti.ojk.go.id · Accessed 14 October 2026
- OJK: Satgas temukan 434 tawaran pinjol ilegal dan modus "salah transfer" (3 Agustus 2023) ↗ojk.go.id · Accessed 14 October 2026
- OJK: waspada penipuan mengatasnamakan OJK soal pemutihan data pinjol ↗ojk.go.id · Accessed 14 October 2026
- OJK: layanan iDebKu (iDeb SLIK) ↗idebku.ojk.go.id · Accessed 14 October 2026
- OJK: Booklet Waspada Penipuan (kanal pelaporan, Agustus 2026) ↗ojk.go.id · Accessed 14 October 2026
- Ditjen Dukcapil: Dukcapil tegakkan prinsip pelindungan data pribadi ↗dukcapil.kemendagri.go.id · Accessed 14 October 2026
- Ditjen Dukcapil: ini cara benar cek NIK KTP-el ke Dukcapil (1 Juli 2024) ↗dukcapil.kemendagri.go.id · Accessed 14 October 2026
Current agency rules take precedence. Editorial method · Report a correction · Markdown version