Everyday money
How to spot online scams in Indonesia: common patterns and what to do in the first hour
Recognise common online scams in Indonesia: APK files, fake aid links, job tasks, fake bank calls, romance scams and QRIS, plus what to do in the first hour.
English edition. Official forms and source documents may be in Indonesian.
QUICK ANSWER
How do I recognise an online scam, and what should I do if I have already been caught?
Online scams usually make you panic or get excited, then ask you to click a link, install an APK file, transfer money or hand over your OTP, PIN and passwords. If it has already happened, call your bank on an official number you look up yourself, report it at iasc.ojk.go.id and change the passwords of your important accounts from a safe device. Make a police report as well; reporting does not guarantee you will get your money back.
See 11 official references ↓Report a scam on the OJK IASC portal ↗iasc.ojk.go.id
Guide contents
What to have ready
- The official helpline number of your bank or e-wallet, taken from your ATM card, the official app or the official website, not from a message you have just received.
- Screenshots of the conversation, the sender’s number or account, links and the names of any files sent.
- Proof of transfer, the time it happened, the amount, and the destination bank and account number.
- Another safe device, such as a family member’s phone, for changing passwords if your phone has been infected by an APK file.
- Your KTP (identity card) and proof that you own the account, for the IASC report and the police report.
Steps for the first hour
Stop contact and disconnect from the internet
Stop replying and do not send any more money. If you have already installed an APK file, Bank Indonesia advises turning off mobile data and Wi-Fi, then uninstalling any suspicious app that appeared after the file was opened.
Contact your bank or payment provider
Call the official number of your bank or e-wallet that you looked up yourself. Report the time, amount and destination account, and ask for your card or account to be blocked temporarily. Do not use any number given in the suspicious message.
Report to IASC
Go to iasc.ojk.go.id, choose Lapor Sekarang (Report now) and fill in your details, the reported party, what happened and the transactions. If you transferred from more than one bank account, make a separate report for each account. Keep the report number sent to your email.
Change your passwords and PINs
Change the passwords for your email, mobile banking, e-wallets, WhatsApp and social media. Use a different password for each account. If your phone may be infected by an APK, do this from another safe device.
Keep the evidence and report to the police
Do not delete the conversation. Take your timeline, proof of transfer and IASC report number to a police station. IASC helps with handling the money, while a police report is the route for law enforcement.
Report the number, account or content
Komdigi (the Ministry of Communication and Digital Affairs) runs aduannomor.id for mobile numbers used in scams, cekrekening.id for bank accounts or e-wallets suspected of crime, and aduankonten.id for websites or content. Tell your family about the trick so they are not the next victims.
Cost of reporting
Free. Reporting to your bank, IASC, Kontak OJK 157, the police and Komdigi’s complaint channels does not require a paid intermediary; aduankonten.id states its service is completely free. Do not pay anyone who promises you will definitely get your money back.
| Pattern | Warning signs | First step |
|---|---|---|
| APK file disguised as an invitation, parcel receipt or official letter | A file ending in .apk from an unknown number or a group; the app asks for permission to read and receive SMS | Do not open it. If installed: disconnect, uninstall the app, call your bank, change passwords |
| Fake bansos, BLT or BSU aid links | Registration or payout links on social media or Telegram asking for your name, NIK or Telegram number | Do not fill it in. Check aid at cekbansos.kemensos.go.id; BSU needs no self-registration |
| Part-time jobs or paid tasks | High pay for easy work, a vacancy sent by private message, being asked to deposit money before commission is paid | Do not deposit anything. Confirm the vacancy through the company’s official website or account |
| Pretending to be a bank, BPJS, the police or an agency | Urgent tone, an unclear number or email, a look-alike logo, requests for your OTP, PIN, password or an immediate transfer | End the contact. Call the organisation on an official number you look up yourself |
| Romance scam | Someone met on social media or a dating app pretends to fall in love, then gradually asks for money or personal data | Do not send money or data. Talk to someone you trust |
| QRIS or bank transfer | The payee name in your app differs from the shop name on the QRIS label; you are directed to transfer to a personal account | Cancel if the name does not match. Contact your payment provider if you have already paid |
According to the IASC FAQ, official news about money that can be returned comes only from the financial institution you transacted with. Anyone claiming to be from IASC, OJK or the police who asks for a fee to recover your money should be treated as a follow-up scam.
The same pattern behind many tricks
The Satgas PASTI booklet published by OJK (August 2026) explains that scammers exploit human weak spots: lack of knowledge (clicking fake links or giving away an OTP), fear (panicking over a threatened fine), greed (promises of big profits or commissions), boredom (cheap ticket or holiday deals) and loneliness (romance scams). Satgas PASTI is the task force against illegal financial activity, made up of regulators, state bodies and ministries.
The booklet recommends the S.T.O.P. approach whenever a contact feels very urgent or too good to be true: notice what is odd (Sadari), pause (Tahan diri), check (Observasi) and protect your data and money (Proteksi). Do not click unclear links, do not share your OTP, PIN or password, and do not transfer money in a hurry without checking again.
An OTP (one-time password) is a single-use code for approving a transaction or logging in. Anyone who asks for your OTP, including someone claiming to be from a bank or an official body, is asking for the key to your account.
APK files and fake registration links
An APK is the installer file format for Android apps. Scammers send them over WhatsApp with names such as a wedding invitation, a parcel photo or an official document. According to BSSN (the National Cyber and Crypto Agency), such apps ask for permission to read and receive SMS; if granted, criminals can read your messages, including SMS banking tokens, and monitor or delete messages without you knowing. BSSN advises installing apps only from official app stores and checking the permissions they request.
If it has already happened, Bank Indonesia recommends five steps: turn off internet access, uninstall the suspicious app, contact your bank, change the passwords of all your accounts and, if you are still unsure, do a factory reset after backing up important data.
For social assistance, Kemensos (the Ministry of Social Affairs) says it has never shared any particular website or link for PKH registration. Registration is through DTSEN data collection at the kelurahan (village office) or a self-nomination in the Cek Bansos app (Komdigi clarification, 24 June 2026). Kemnaker (the Ministry of Manpower) has also stated that BSU wage subsidies need no self-registration and that information is published only on Kemnaker’s BSU page and its official social media (7 January 2026).
Impersonation, job offers, romance scams and QRIS
Impersonation means a scammer pretends to be a bank, a government agency or a well-known figure. The signs listed by Satgas PASTI are contact from an unclear number or email, a sense of emergency, a look that copies an official body, and requests to send money or share your PIN, OTP and password. Stay calm, end the call and contact the organisation yourself.
Job-offer scams usually claim to be from a large company, offer easy conditions and high pay, then ask for an upfront payment or your financial account details. This includes part-time work that promises a big commission after you deposit money. In a romance scam, the scammer builds a relationship through social media or a dating app, pretends to fall in love, then gradually asks for money or personal data.
When paying by QRIS, Bank Indonesia asks consumers to make sure the merchant name shown in the app is correct and not to go ahead if anything seems wrong. Merchants are asked to check their QRIS label regularly so that nobody else can replace it.
Reporting to the right channel
If you have lost money in a transaction scam, report it to the Indonesia Anti-Scam Centre (IASC) at iasc.ojk.go.id. IASC says speed of reporting is critical to the chance of the bank freezing the money. If you come across illegal online lending, illegal investments or illegal pawn services, report them to Satgas PASTI at sipasti.ojk.go.id.
For questions, Kontak OJK can be reached by phone on 157, WhatsApp 081 157 157 157 or email at konsumen@ojk.go.id. The Satgas PASTI booklet gives service hours of 07.45–16.50 WIB (Western Indonesian Time).
Komdigi provides three complaint channels: aduankonten.id for websites, social media content and games that break the ITE Law; aduannomor.id for misused mobile numbers; and cekrekening.id for checking or reporting suspicious bank accounts and e-wallets. Reports on aduankonten.id must include the link, a screenshot and the reason. The site itself directs scams involving financial loss to IASC.
Things to check carefully
- Contacting a number, link or account given in a suspicious message to "verify" it. Use an official number you look up yourself from your card, the official app or the official website.
- Paying an "admin fee" or "tax" to release a prize, commission or aid payment. Satgas PASTI points out that genuine prizes do not ask for extra fees.
- Giving your OTP, PIN or password to someone claiming to be from a bank, OJK, BPJS or the police.
- Waiting until all the evidence is tidy before calling the bank. Sort out the timeline while or after you call.
- Trusting someone who claims to be from IASC, or a lawyer, promising to recover your money for a fee. IASC reports are made only at iasc.ojk.go.id.
Frequently asked questions
What should I do if I have already installed an APK file from WhatsApp?
Turn off mobile data and Wi-Fi, uninstall the suspicious app, contact your bank and change the passwords of all your accounts from a safe device. These are the steps Bank Indonesia recommends. If you are still unsure, back up important data and do a factory reset. If money has already gone, also report it at iasc.ojk.go.id and to the police.
Does Kemensos share links for registering for social assistance?
No. Kemensos says it has never shared any particular website or link for PKH registration. Registration is through DTSEN data collection at the kelurahan or a self-nomination in the Cek Bansos app. Links asking for personal data in Kemensos’s name are likely phishing, meaning an attempt to steal data.
How can I check that a call from my bank is genuine?
End the call, then contact the bank on the number printed on your ATM card, in the official app or on the official website. Genuine staff do not need your OTP, PIN or password. Satgas PASTI asks the public not to give these out even to people claiming to be from an official body.
Where do I report a scammer’s bank account?
If you have already transferred money, report it to your bank and at iasc.ojk.go.id so the destination account can be blocked where possible. To report a suspicious bank account or e-wallet without a direct loss, Komdigi provides cekrekening.id. A scammer’s phone number can be reported at aduannomor.id.
Will I definitely get my money back after reporting?
No. IASC states there is no guarantee of recovery. The chances are better if you report as quickly as possible and the money can still be traced. See the guide to reporting scams for the full steps.
How do I recognise a part-time job scam?
Be wary of vacancies that arrive by private message, offer high pay for easy conditions, or ask you to deposit money so your commission can be paid. Satgas PASTI advises confirming a vacancy through the company’s official website or account and contacting the company directly.
What is a romance scam?
A romance scam is fraud disguised as a relationship. The scammer makes contact through social media or a dating app, pretends to fall in love, then gradually asks for money or personal data. Do not send money or data to an online contact you have not met and verified.
How do I pay safely with QRIS?
After scanning the code, check the merchant name shown in your app before tapping pay. Bank Indonesia asks consumers not to continue if anything seems wrong, for example if the payee name differs from the shop name. Keep the payment notification as proof.
Sources and review
Editorial review of public information: . This is not a review by an agency officer or a professional adviser. Reviewed by Kaiser Khan, publisher of Panduan Warga. Official document titles are retained below.
- OJK: Booklet Waspada Penipuan (Scam) Mengintai Kita (Satgas PASTI, Agustus 2026) ↗ojk.go.id · Accessed 14 October 2026
- OJK: PDF booklet Waspada Penipuan Mengintai Kita ↗ojk.go.id · Accessed 14 October 2026
- OJK: portal dan FAQ Indonesia Anti-Scam Centre (IASC) ↗iasc.ojk.go.id · Accessed 14 October 2026
- BSSN: imbauan keamanan modus penipuan undangan pernikahan elektronik .APK ↗www.bssn.go.id · Accessed 14 October 2026
- Bank Indonesia: telanjur klik APK penipuan? Segera ikuti 5 langkah ini ↗www.bi.go.id · Accessed 14 October 2026
- Bank Indonesia: edukasi masyarakat dan merchant agar terhindar dari penyalahgunaan QRIS (11 April 2023) ↗www.bi.go.id · Accessed 14 October 2026
- Komdigi: [HOAKS] tautan pendaftaran bantuan PKH Rp1,7 juta dari Kemensos (24 Juni 2026) ↗www.komdigi.go.id · Accessed 14 October 2026
- Kemnaker: imbauan waspadai informasi hoaks tentang BSU 2026 (7 Januari 2026) ↗kemnaker.go.id · Accessed 14 October 2026
- Komdigi: AduanKonten.id dan FAQ ↗aduankonten.id · Accessed 14 October 2026
- JDIH Komdigi: infografis layanan CekRekening.id ↗jdih.komdigi.go.id · Accessed 14 October 2026
- BPSDM Komdigi: tiga kanal resmi aduankonten.id, cekrekening.id, aduannomor.id (10 Maret 2026) ↗bpsdm.komdigi.go.id · Accessed 14 October 2026
Current agency rules take precedence. Editorial method · Report a correction · Markdown version