SIM Swap Scams in Indonesia
Criminals hijacking Indonesian mobile numbers to intercept OTP codes and drain mobile banking and e-wallet accounts.
Part of: SIM Swap Scams
Last reviewed: 1 June 2026
SIM swap attacks in Indonesia primarily target mobile banking users of BCA, BRI, Mandiri, and BNI, as well as e-wallet balances in GoPay, OVO, and DANA. With many Indonesians using SMS or WhatsApp OTP for authentication, control of a phone number provides near-complete access to financial accounts.
Fraudsters typically socially engineer or bribe telco staff at Telkomsel, Indosat, XL, and Tri stores to execute unauthorized SIM swaps. Pre-gathered personal data from data breaches or social engineering calls is used to impersonate the account holder.
How this scam works on Indonesia
A fraudster collects the victim's NIK (national ID number), phone number, and date of birth through phishing, social engineering calls, or purchased data breach datasets. Armed with this, they visit a carrier store with a forged ID and request a SIM replacement, claiming the original was lost or damaged.
Once the new SIM is active, the victim's device loses signal. Within minutes, the fraudster resets mobile banking passwords using intercepted SMS OTPs and transfers funds via BI-FAST. E-wallet accounts (GoPay, OVO) are similarly drained. Because BI-FAST transfers are near-instant, recovery is very difficult.
WhatsApp account takeover also enables the fraudster to impersonate the victim to their contacts and request emergency money transfers — a 'modus penipuan WA' common in Indonesian media reports.
Common red flags
- Sudden loss of mobile signal without any network issues in your area
- SMS notification confirming a SIM card change you did not request
- Bank app OTP codes arriving for sessions you did not initiate
- WhatsApp active session showing a new device you do not recognize
- Contacts report receiving money requests from your number
How to protect yourself
- Register a SIM card PIN with your carrier (Telkomsel, Indosat, XL) to prevent unauthorized swaps
- Switch from SMS OTP to authenticator app or biometric authentication for banking apps
- Enable transaction notifications on all mobile banking and e-wallet apps
- Immediately call your carrier and bank if your phone loses signal unexpectedly
- Limit personal data shared on social media that could be used to impersonate you
How to report it
- Contact your carrier's fraud line immediately to block and restore your SIM
- Report to your bank's fraud hotline and request an account freeze
- File a report with Bareskrim Polri at patrolisiber.id
Frequently asked questions
Can I recover funds transferred out via BI-FAST after a SIM swap in Indonesia?
Recovery is difficult because BI-FAST transfers are instant. Report immediately to your bank's fraud hotline — banks can sometimes freeze the recipient account if reported within hours. Also file with Bank Indonesia and Bareskrim to support the investigation.