You opened a link from an email, SMS, or WhatsApp message, then entered a password, OTP code, or card details on a page that turned out to be fake. Criminals can use that data within minutes, so take the steps below as quickly as possible.
Signs
- The website address in your browser differs from the official address: extra letters, hyphens, numbers, or a different domain.
- The login page was opened from a link in a message, not from the app or the address you normally type yourself.
- The message that prompted it was urgent, for example saying your account will be blocked, a bill is unpaid, or a prize must be claimed today.
- After you entered your password, the page simply reloaded or went straight to the real website.
- You receive login notifications or OTP requests you did not ask for.
Do this now
- If you entered card details, a PIN, or a bank OTP, call your bank's official call center listed on the back of your card or in the official app, and ask for your card and mobile banking access to be blocked.
- Change the password of the account you entered. Open the official site by typing its address yourself, not through that link.
- Also change the passwords of other accounts that use the same password.
- Use the account security menu to log out of all devices.
- Enable two-step verification (2FA).
- Check settings that attackers often change: recovery email and phone number, email forwarding rules, and the list of connected devices.
- Keep evidence: screenshots of the message and the fake page, the full link address, and the time of the incident.
- If you downloaded or opened a file from that link, disconnect the device from the internet and follow the device infected with malware page.
Don't
- Do not reply to the scammer or send OTP codes to anyone, including people claiming to be bank staff or administrators.
- Do not forward that link to group chats for others to try.
- Do not delete the original message before the evidence has been saved.
- Do not write your password in the report form or in emails to KUTIM-CSIRT.
Report
Report it through /lapor under the category Phishing / Rekayasa Sosial (phishing / social engineering). Choose severity Tinggi (High) if an official account password, card details, or an OTP has been entered, and Sedang (Medium) if you only opened the link without entering anything. Attach screenshots of the message and the fake page (maximum 5 files, 5 MB each) and write the link address in the description. Keep the ticket number and token shown after the report is submitted so you can follow up at /lacak-tiket.
If money has already been debited, also report it to your bank and to the Indonesia Anti-Scam Centre (IASC) OJK.
To prevent a recurrence
- Open important services through their official app or an address you have saved as a bookmark.
- Use a different password for each account and store them in a password manager.
- Enable 2FA on your email, social media, and financial apps.
- If you are unsure about a link, check it first at /cek-phishing before opening it.
- Remember that banks and app administrators never ask for OTPs or passwords by message or phone.