Someone contacted you via WhatsApp, phone, or SMS claiming to be a bank officer, customer service agent, courier, or acquaintance, and asked you to transfer money, share an OTP code, or install an APK file disguised as a wedding invitation, a parcel photo, or a traffic ticket. Scammers move funds quickly, so contact your bank as soon as possible.
Signs
- The caller or sender is pushy and threatening, for example saying your account will be blocked or your parcel is being held.
- You are asked to give out an OTP code, PIN, or password.
- The sender sends a file ending in
.apkor a link to download an app. - An account claiming to be a bank uses a personal number, or the customer service number was found in an advertisement or social media comments.
- After installing the APK, you receive OTP text messages you did not request, or your balance decreases.
Do this now
If you have already transferred money or given out an OTP:
- Call your bank's official call center listed on the back of your card or in the official app. Ask for mobile banking access and your card to be blocked, and ask about blocking the destination account.
- Report it to the Indonesia Anti-Scam Centre (IASC) OJK as soon as possible. Prepare your personal details, the scammer's details (name, phone number, social media accounts), the date, time, and amount of the transfer, and the proof of transfer.
- Keep all evidence: screenshots of the conversation, the scammer's number, the destination account, and the proof of transfer.
If you have already installed the APK you were sent:
- Turn on airplane mode on that phone.
- From another phone, call your bank's official call center and ask for mobile banking access to be temporarily blocked.
- Remove the app via Settings > Apps. If it cannot be removed, first revoke its permissions in the Accessibility menu and the device admin apps menu.
- From another device, change the passwords for your email and the apps installed on that phone.
- If the app still cannot be removed or the symptoms continue, back up your photos and contacts, then perform a factory reset.
- In WhatsApp, check Linked Devices and enable Two-Step Verification.
Don't
- Do not transfer any unblocking fee or refund fee. People who promise to return your money for a fee are usually part of the same scam.
- Do not contact customer service numbers given by the scammer or found in advertisements.
- Do not give your OTP code to anyone.
- Do not delete your conversation with the scammer before taking screenshots.
- Do not install APKs from WhatsApp, SMS, or any site other than an official app store.
Report
For money that has already been transferred, the main channels are your bank and IASC OJK above. Scammers' accounts can be checked and reported at cekrekening.id (Ministry of Communication and Digital Affairs). For criminal proceedings, file a police report at the nearest police station, bringing evidence of the conversation, the scammer's number, and the proof of transfer.
Also report it to KUTIM-CSIRT through /lapor under the category Phishing / Rekayasa Sosial (phishing / social engineering), especially if the scammer used the name of the East Kutai Regency Government or the victim is an OPD employee. Choose Tinggi (High) if money has already moved or the APK was installed on a phone used for official accounts, and Sedang (Medium) if you did not follow the scammer's requests. Attach screenshots of the conversation and the scammer's number, and write down the APK file name if there is one.
To prevent a recurrence
- Contact your bank only through the number on the back of your card or in the official app.
- Turn off permission to install apps from unknown sources on Android.
- Enable Two-Step Verification in WhatsApp.
- If an acquaintance asks for money over chat, call them back on the number you saved yourself.
- Check the destination account at cekrekening.id before transferring money to anyone you do not know.