Cybersecurity

Social engineering is any attempt to trick a person into giving away information, money or access. It works on people rather than machines. The attacker builds trust, or creates fear or urgency, so that the victim does the harmful thing themselves: shares a password, sends a payment, opens a file, or installs an app.

Indonesia's national cyber agency, BSSN, describes it the same way: the attacker relies on human error and pressure, so victims harm themselves or their organisation without realising it. BSSN names phishing as one of the most common threats people in Indonesia meet.

Phishing is social engineering through a message or a fake website. The message pretends to come from someone you trust, such as a bank, a courier, a marketplace, a government office or your own boss, and asks you to click, log in, pay or reply.

It comes in several forms:

• Email phishing: a message that looks like it comes from a real company, with a link to a fake login page or a harmful attachment.
• Spear phishing: phishing aimed at one person or a small group, using details about them (their name, job, colleagues or recent purchases) to look genuine.
• Smishing: phishing by SMS or chat apps such as WhatsApp.
• Vishing: phishing by voice call, often from someone claiming to be bank staff, police or a relative.
• QR-code phishing: a QR code on a poster, parcel or message that leads to a fake website.
• Business email compromise: a criminal pretends to be, or takes over the email of, a company leader or supplier, and asks staff to send money or change bank details.
• Impersonation: posing as family, a colleague, a boss, a customer service agent or an official. OJK's Indonesia Anti-Scam Centre names impersonation and fake calls among the methods used against the people who report to it.

AI has not invented a new kind of attack. It makes the old ones cheaper, faster and harder to spot. The US FBI warned in December 2024 that criminals now use AI in four ways:

• Text: messages written without the spelling and grammar mistakes people used to look for, in any language, tailored to the reader.
• Images: fake profile photos, fake identity documents and fake endorsements by well-known people.
• Voice: a cloned voice of a family member, colleague or leader, made from short recordings found online.
• Video: deepfake video in which a real person's face and voice appear to say things they never said, including in live video calls.

Europe's police agency, Europol, reported in 2025 that generative AI lets criminals target messages more precisely and automate much of their work. Indonesia's Investment Alert Task Force (Satgas PASTI, under OJK) warned in November 2025 that voice cloning and deepfake video are now two of the main methods used in AI-assisted fraud.

Good grammar, a familiar voice or a familiar face no longer prove that a message is genuine.

1. Pause. Urgency and secrecy are the attacker's main tools. Take a moment before you click, pay or reply.
2. Check through another channel. If a message or call asks for money or data, contact the person or company yourself, using a number or address you already know. Do not use the one in the message.
3. Agree a family code word. Choose a word or phrase only your family knows, and ask for it in any call that asks for money in a hurry.
4. Ask a question only the real person can answer. If the answer is wrong or the caller avoids it, hang up.
5. Never share a one-time code. Banks, couriers and government offices never need your OTP, PIN or password.
6. Do not install apps sent in chat. Install apps only from the official app store.
7. Turn on two-step verification, and prefer an authenticator app or security key over SMS codes where you can.
8. Use a different strong password for each account, kept in a password manager, and keep your phone and apps updated.
9. Share less in public. Keep social media accounts private where you can; public videos and voice recordings are the raw material for voice and face cloning.
10. Never send money to someone you know only online or by phone.

1. Confirm every change of bank details by calling the supplier or customer on a number you already hold, never the one in the email.
2. Treat urgency and secrecy as warning signs, especially when the request seems to come from the owner or a director.
3. Turn on two-step verification first for email, file storage, remote access and administrator accounts.
4. Give each person their own login, with a unique password, and never share passwords by email or chat.
5. Check web addresses carefully for small spelling changes before you log in or pay.
6. Talk to your team about how these scams work, using the cases on this page.
7. If money has been sent, act at once. Call your bank immediately to ask for the transfer to be stopped, then report it.

If you have lost money, speed matters: the sooner a report is made, the better the chance the money can be blocked.

• Your bank first. Call your bank's official call centre at once and ask for the account or transfer to be blocked. Use only the number on your card or the bank's official website, never one from a search advert or a social media reply.
• Indonesia Anti-Scam Centre (IASC), iasc.ojk.go.id. OJK's centre for financial transaction fraud. Report there so the receiving account can be blocked quickly. Have ready your ID, the scammer's details, both bank accounts, the date, time and amount, and proof of the transfer, which is required.
• The police. IASC advises also making a police report at your nearest police station.
• OJK contact centre, 157. For questions about financial services, illegal investments and illegal online loans (OJK's Satgas PASTI can also be reached on WhatsApp at 081 157 157 157).

Only your own bank or payment provider will contact you about money that has been recovered. Anyone else who offers to get your money back for a fee is another scam.