Protect payment accounts against impersonation, replaced QR codes and stolen mobile access. Indonesia’s official reporting routes can help institutions respond, but a report is not a guarantee that transferred funds will be recovered.
Know what IASC is designed to receive
The IASC portal describes financial-scam coordination between the reporting channel and relevant institutions. It asks victims to preserve transfer evidence, account details and communications, and distinguishes financial reporting from a police report. Use the portal reached from the official OJK domain, save the case number and track the response there. A copied logo or a search advertisement is not sufficient proof that a recovery service is genuine. You do not need to continue a conversation with a suspected scammer to make the evidence more persuasive.
Protect the number linked to your wallet
The OVO security guidance identifies SIM swapping as a way an attacker can obtain verification messages. An unexpected loss of service deserves prompt checking with your operator, particularly if account activity changes at the same time. The Telkomsel eSIM guidance treats activation QR information as private. Do not share that code in a support forum or with a stranger claiming to optimise your connection. Keep a separate way to reach your provider so that losing access to one mobile number does not prevent reporting the problem.
Comparison of evidence and checks
| Question | What the evidence supports | What to verify |
|---|---|---|
| Unexpected QR recipient | Possible code substitution | Stop and verify with the merchant |
| Mobile service suddenly lost | Possible service fault or account takeover | Contact operator through known channel |
| Money already transferred | Financial incident needs rapid reporting | Provider, IASC and appropriate police route |
| Paid recovery promise | A further potential scam | Do not send more money or credentials |
A practical situation to work through
A message claims that your ticket payment failed and asks you to install a new application to obtain a refund. Instead of following the message, open the ticket seller’s site from your saved booking and check the original order. If you already installed the application and it requested screen-control permissions, use another trusted device to contact the wallet or bank. Write down what was installed, when and which account was open; do not repeatedly test the suspicious app. If money moved, preserve the actual transaction reference rather than only the threatening chat. For a malicious page or account, Komdigi’s content-reporting instructions provide a separate reporting path. The aim is containment and a clear evidence trail, not negotiating with whoever sent the message.
Interrupt the pressure before checking the claim
Stop interacting with a message that demands secrecy, urgency, a new payment or installation of unfamiliar software. Use a different, trusted route to contact the organisation it claims to represent. A real name, logo, transaction amount or caller display is not sufficient authentication. Do not read out a one-time password, share a banking screen or approve a login you did not start. If an app has been installed at a stranger’s request, stop using that device for financial activity and seek help through a clean device or an official service point.
Checklist when money or access is at risk
- Contact the affected bank or wallet through its established fraud channel and ask it to restrict the compromised access. Contact the mobile operator if your number unexpectedly loses service.
- Preserve the message, URL, transaction reference and relevant times without opening attachments again. Make the appropriate official report and retain its number.
- Warn contacts privately if your messaging account sent fraudulent requests. Do not publish identity documents or complete account numbers while seeking help.
- A suspicious-message report, an institution complaint and a police report can be separate processes.
Recovery should not require a new payment
No editorial guide can guarantee that transferred funds will be recovered. Be wary of people who claim they can retrieve money in return for an advance fee, cryptocurrency transfer or banking password. Record what each legitimate institution has actually confirmed, and distinguish a report received from funds frozen or returned. After containment, review email security, active sessions, recovery contacts and reused passwords. The purpose is to remove the access path and preserve evidence, not to investigate a suspect yourself or confront someone using personal information found online.
Frequently asked questions
Does this observatory operate the service?
No. This is independent editorial information. The named organiser, broadcaster, payment institution or public body operates its own service and sets its own conditions. Use the linked primary source for the action you need.
Are these details permanent?
No. The evidence was checked on 23 October 2026. Match schedules, rights, account limits, provider conditions and complaint procedures can change. Confirm the current information before making a payment, travelling or submitting a case.
What should I save for a later enquiry?
Keep the relevant official page or receipt, its date, the reference number and a short description of what occurred. Store personal and payment information privately, and submit it only through the appropriate verified support channel.
Sources and verification
- Indonesia Anti-Scam Centre — OJK / IASC — 2026-10-23
- OVO limits and user protection — OVO — 2026-10-23
- Telkomsel eSIM requirements — Telkomsel — 2026-10-23
- Reporting unlawful online content — Komdigi — 2026-10-23