Indonesia Scams: Online, Job & Investment Fraud Guide
Common scams in Indonesia and how to report via Patroli Siber, the national police, and your bank.
Emergency number: 110 (police), 112 (emergency) — verify on official sources.
Last reviewed: 1 August 2026
Indonesia experiences high volumes of online fraud including e-commerce scams, phishing targeting mobile banking and e-wallets, investment Ponzi schemes, and job scams. The Bareskrim Polri cybercrime unit operates Patroli Siber (patrolisiber.id) — the official platform for reporting cybercrime — and Indonesia is also a significant source and target of task scams and pig-butchering operations linked to regional organised crime.
A distinctly Indonesian threat is the malicious APK sent by WhatsApp: a file disguised as a wedding invitation ('undangan pernikahan'), package-delivery notice, or bank letter that, once installed, reads SMS messages and drains mobile banking and e-wallet accounts (GoPay, OVO, DANA, ShopeePay). Never install APK files sent through chat, however plausible the pretext. Illegal online lending apps ('pinjol ilegal') are the second local plague: they disburse small loans instantly, then extort repayment at extortionate rates by harassing the borrower's entire contact list — which the app copied at install time. Use only OJK-registered lenders and assume any loan app demanding full contact access is predatory.
Investment fraud has deep roots, from 'arisan' rotating-savings schemes turned Ponzi, to fake gold and 'robot trading' platforms, to influencer-fronted binary options that ended in high-profile prosecutions. Verify any platform against OJK's licensed lists before depositing. E-commerce fraud on and off Tokopedia, Shopee, and Instagram runs from non-delivery to fake customer-service accounts on social media that 'help' with refunds by phishing your OTP. Job scams recruit for fake admin roles requiring deposits, and 'overseas customer service' offers can be trafficking lures into scam compounds elsewhere in the region. Report to your bank or e-wallet provider first, then Patroli Siber, and keep every chat and account number involved.
Common scams
- E-wallet and mobile banking phishing (GoPay, OVO, Dana)
- Investment Ponzi and pyramid schemes
- Task scams via messaging apps
- Fake online shops and marketplace non-delivery
Tourist-specific scams
- Overcharging unlicensed taxis and ride-hailing scams
- Fake tour and adventure operators in Bali and other tourist areas
- Counterfeit goods and gem scams
Online shopping scams
- E-wallet phishing impersonating GoPay, OVO, or Dana
- Fake online shopping sites and Tokopedia/Shopee impersonation
- SIM swap fraud enabling account takeover
Job scams
- Task scams requiring deposits to 'unlock' earnings
- Fake overseas job offers (some linked to regional scam compounds)
- Fake admin/data-entry roles charging 'uniform' or 'registration' deposits
Romance scams
- Dating-app romance and pig-butchering crypto investment grooming
- Foreigner personas asking for customs fees on 'gift packages'
- Video-call sextortion via dating and social apps
Investment scams
- Fake investment apps and unlicensed forex/crypto platforms
- Community Ponzi schemes targeting religious or ethnic groups
- 'Arisan' rotating-savings schemes converted into pyramid fraud
How to report a scam here
- Contact your bank or e-wallet provider immediately to freeze the account
- Report cybercrime to Patroli Siber at patrolisiber.id
- File a criminal complaint with the nearest Polri station
Local reporting & protection links
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Bank & payment guidance
Contact your bank or e-wallet provider straight away through their official app or hotline, and ask them to freeze the account and stop or recall the transfer. Speed matters, because funds are usually moved on through mule accounts quickly. Say clearly that you were tricked into authorising the payment, ask for the receiving account to be reported, and note the reference number. If you installed an APK from a chat message, assume the device is compromised: stop banking on it, tell the provider explicitly that malware may have read your SMS codes, and reset the phone before logging in again. Never share OTPs or m-banking PINs with anyone — including 'customer service' accounts that reply to complaints on social media, which are frequently fake — and if you already shared one, say so immediately and change credentials from a clean device. File a Patroli Siber report so the bank has an official case to attach the freeze request to.
Evidence to preserve
- Screenshot all messages, profiles, websites and payment pages
- Save transaction references, account numbers and crypto wallet addresses
- Keep emails with full headers where possible
- Note dates, times, names and phone numbers used
Frequently asked questions
What is Patroli Siber?
Patroli Siber is the Indonesian National Police's official cybercrime reporting and monitoring platform at patrolisiber.id, operated by Bareskrim Polri's Cyber Crime Directorate. Citizens can report cybercrime incidents and receive guidance online.
Are investment apps registered with OJK safe?
Always verify an investment platform is registered with OJK (Otoritas Jasa Keuangan — the financial regulator) before investing. Check the OJK official website for licensed entities. Unregistered platforms are a major red flag.
What is the WhatsApp 'wedding invitation' APK scam?
A contact — often a hacked account — sends an APK file disguised as a wedding invitation, delivery notice, or official letter. Installing it gives malware access to SMS and notifications, letting fraudsters intercept banking OTPs and drain accounts. Never install APKs from chat; if you did, stop using the phone for banking and reset it.
Sources
- National police and cybercrime portals (verify on official sites)
- FTC / Action Fraud / Scamwatch consumer guidance