Phishing Cases Disguised as Financial Services Continue to Rise in Indonesia
Phishing-based cybercrime targeting the financial services sector has continued to show an upward trend throughout 2026. According to data compiled by the Indonesia Anti-Scam Center, from the center’s launch in November 2024 through January 31, 2026, there were 448,442 reported cases of fraud involving 756,006 accounts suspected of being compromised, and more than 415,000 of those accounts have already been blocked. These figures illustrate the scale of the phishing problem, which has now become a serious threat to the stability of the national digital financial ecosystem.
The Indonesia Anti-Scam Center itself is the result of a collaboration between the Task Force for the Eradication of Illegal Financial Activities and various parties—such as banks, payment service providers, and the e-commerce sector—formed to handle reports of financial sector fraud more quickly and to deter perpetrators. Data from other sources even indicates that the financial sector is the primary target of phishing, accounting for approximately 41.70 percent of all attacks—far exceeding the rates for the social media and e-commerce sectors.
Schemes Targeting Banking Services
One point of concern raised by academics relates to the proliferation of fake websites that mimic official banking services, including digital business banking services. Lukman Hakim, a Computer Science lecturer at Muhammadiyah University of Surabaya, explained in a statement on Tuesday, January 27, 2026, that banking phishing typically begins with a message that appears convincing—as if it came from a bank or official institution—sent via email, SMS, or instant messaging apps. Victims are then directed to a fake website that looks very similar to the official site, so that as soon as they enter their user ID, password, or OTP code, the perpetrators immediately steal that data to drain their accounts.
In addition to phishing via fake websites, “vishing”—scams carried out through direct phone calls—is also becoming increasingly common, including the use of VoIP technology to spoof the caller’s identity so it appears to be an official number from a bank or government agency. Perpetrators generally create a sense of urgency to make victims panic and prevent them from verifying the accuracy of the information before handing over their sensitive data.
Law Enforcement Action Against Phishing Syndicates
On the law enforcement front, the Indonesian National Police’s Criminal Investigation Agency, in collaboration with the Federal Bureau of Investigation, successfully dismantled a network of phishing tool developers targeting digital wallet users on Saturday, April 25, 2026. The Indonesian National Police confirmed that legal proceedings against the suspects are ongoing, including further investigation to trace the flow of funds derived from these cybercrimes. Authorities also urge the public never to share OTP codes with anyone, including individuals claiming to be official customer service representatives.
Other recommended preventive measures include periodically checking transaction histories on digital wallet apps to detect suspicious activity, using security apps with features to filter out malicious websites, and reporting any suspicious links to official government complaint channels or law enforcement authorities.
The Financial Sector’s Response to Phishing Threats
A number of financial institutions in Indonesia have begun strengthening cybersecurity training programs for customers, covering the identification of phishing patterns, how to verify the authenticity of official apps, and the importance of keeping PINs confidential. Several banks are also developing artificial intelligence-based detection systems capable of automatically recognizing suspicious transaction patterns.
The Financial Services Authority (OJK), as the regulator, has issued regulations requiring financial institutions to conduct cybersecurity audits at least twice a year. This policy is part of efforts to curb the rising losses caused by phishing, while maintaining public trust in digital financial services amid the increasing complexity of current cybercrime methods.
