Keep passwords safe, turn on 2-Step Verification, back up your phone, and know what to do with a fake bank message or a hacked account.
Safe and Secure
How Online Scams Work
Most online scams follow one four-stage pattern: an impersonated sender creates urgency, pushes a dangerous link or file, and rushes you into sending a code or money.
Stage 1 (Who They Pretend to Be) lights: a message claims to come from your bank, courier, tax office or a relative.
1 / 5
Stage 1 (Who They Pretend to Be) lights: a message claims to come from your bank, courier, tax office or a relative.
Stage 2 (The Urgency Hook) lights: the sender claims an account block, prize draw, unpaid fee or family emergency.
Stage 3 (The Trap) lights: the message pushes a fake web link, an APK file ("undangan.apk", "resi.apk") or an OTP request.
Stage 4 (The Pause Gate) lights: stopping to verify on a separate official number breaks the scam before money moves.
Stage 5 (If Money Moved) lights: report at once at iasc.ojk.go.id and file a police report with transfer proof.
1/ 5
Stage 1 (Who They Pretend to Be) lights: a message claims to come from your bank, courier, tax office or a relative.
Most online scams follow one four-stage pattern: an impersonated sender creates urgency, pushes a dangerous link or file, and rushes you into sending a code or money.
Everyday Comparison
Think of a stranger knocking on your shop door at closing time wearing a courier vest, waving an urgent bill and asking you to sign and pay before you check the parcel. The vest is the disguise, the rush is the trick, and pausing to call the real office breaks the trap.
What It Means for Your Business
One clicked `.apk` file or shared OTP code on a shop phone can drain a business bank account or hijack the WhatsApp number your buyers trust. Train everyone who handles orders or payments to pause whenever a message creates panic, never install apps outside Google Play, and verify any payment change by calling the known number on file.
Examples
A WhatsApp message sending "resi.apk" or "undangan.apk" that steals SMS banking codes when installed
A fake bank SMS warning of a suspicious transaction or fee change with a link to a lookalike login page
A message pretending to be a supplier announcing a sudden bank-account change right before an invoice is due
Open the Settings app, tap Google, then Backup, and follow the on-screen instructions the first time. The backup can take up to 24 hours, and backup and restore need Android 8 or higher.
Tap Manage backup to review your settings and scroll to Backup details to see what is included. App data, settings and messages can only be restored while you set up a phone, not afterward.
Back up photos and videos separately, because the device backup does not hold them. Open Google Photos, sign in, tap your avatar in the upper-right corner, open Photos settings, choose Backup and switch it on.
Watch your storage. Google Account storage is shared by Google Photos, Google Drive and Gmail. If it is full, buy more storage or free up space, and a photo may show "Not enough storage to back up."
Upload important files such as price lists and invoices to Drive. On a computer, go to drive.google.com, click New, choose File Upload or Folder Upload and select the files. With Drive for desktop, files you drag into the Google Drive folder sync to drive.google.com.
Know the limits. Turning off backup deletes your device backups, and if you do not use the device for 57 days, backed-up data other than photos and videos is erased.
Go to the Bitwarden sign-up page, enter your email address and pick a server region (bitwarden.com or bitwarden.eu). Bitwarden sends a verification email, so open it and confirm your address.
Create a master password that is memorable and strong. Bitwarden says a stronger password is longer, more complex and less common, and master passwords created after the 2023.3.0 release must be at least 12 characters.
Remember the master password. Bitwarden states that its employees and systems cannot retrieve or reset it.
Save a login. In the web vault select New, then Login, enter an item name, your username, your password and the website address, then select Save.
Make a new password with the Generator (Tools, then Generator in the web app). Choose a password or a passphrase and set the length. Keep the minimum numbers and special characters at 0 or 1 unless a site requires more.
Set up two-step login for your vault and save the recovery code. Bitwarden calls this a critical step so you do not get locked out, and suggests printing the code and storing it somewhere safe.
OJK warns about SMS messages that look like they come from a bank and carry a dangerous link. If you have already sent money to a scammer, the Indonesia Anti-Scam Centre (IASC) takes reports through its official website.
Treat an SMS that claims to be from a bank as a warning sign when it mentions a suspicious transaction, a prize draw or a promotion and includes a link. OJK says clicking such a link can steal personal data and drain bank accounts.
Do not rush to click links, download apps or follow instructions in a message before you check whether it is true and who sent it. OJK also names APK files and fake messages about a family member needing help as common tricks.
If you already sent money, report at once. IASC says scammers move money within minutes, so delay can leave little to freeze. Use the IASC portal at iasc.ojk.go.id, which aims to block the transaction and gives you a ticket number.
File a police report (Laporan Polisi) at the nearest police station as well. IASC lists this as the second thing to do for the legal process.
Prepare your details before you start: your ID, the scammer's phone number or account and where you met them, a timeline with dates and times, your bank and account, the recipient's bank and account, and the transfer date, time and amount. Proof of transfer is mandatory, and chat screenshots help.
Report only on the official IASC website. Satgas PASTI warned in March 2025 about fake websites that use the IASC name. To check information about IASC, OJK lists phone 157, WhatsApp 081 157 157 157 and email konsumen@ojk.go.id.
Keep your expectations realistic. IASC states that a report does not guarantee you get your money back. If funds are recovered, only the bank or payment provider you used will contact you.
2-Step Verification adds a second check to your Google Account in case your password is stolen. Setting it up on a computer takes a few minutes.
Open your Google Account and select Security & sign-in. If you use a work, school or other organization-managed account, these steps may not work, so ask your administrator.
Under how you sign in to Google, select Turn on 2-Step Verification, then follow the on-screen instructions.
Choose a second step. The options Google lists are a Google prompt on your phone, a passkey or hardware security key, a code from an authenticator app, and a text or voice code.
Know the difference in strength. Google says passkeys and hardware security keys give the strongest protection against phishing, and text or voice codes are more open to attacks that target phone numbers.
Create backup codes. Google can generate a set of 8-digit codes that you print or download. Use one as your second step if you lose your phone, keep them somewhere safe and do not share them.
Use "Don't ask again on this device" only on a personal computer or phone that nobody else uses.
Try to sign in. If you cannot, use Google's account recovery page and answer the questions as best you can. Use it if someone changed your password or recovery phone, deleted your account, or you cannot sign in for another reason.
Change your Google Account password. Also change the password on any app or site that uses the same password.
In your Google Account, open Security & sign-in and select Review security events. If you see activity you did not do, select "No, it wasn't me" and follow the on-screen steps.
Under Your devices, open Manage devices and remove any device you do not recognize.
Turn on 2-Step Verification, so a second factor such as your phone or a security key is needed along with your password.
Contact your bank or local authorities if someone may have used your saved payment or personal information.
In Gmail, remove labels, filters and forwarding rules you do not recognize.
Before taking an online business loan, check whether the lending platform holds an official license from OJK through WhatsApp 081-157-157-157 or the official ojk.go.id website.
Identify the exact lender: note the legal entity name and application name from the loan offer before sharing any personal business data.
Save the official OJK WhatsApp contact number 081-157-157-157 in your smartphone contact list.
Send a WhatsApp message to OJK with the exact company or application name to receive instant automated licensing verification.
Check the official OJK website at ojk.go.id under the fintech lending directory if you prefer verifying via a web browser.
Stop immediately if the platform is unlisted, unlicensed, or approaches you through unsolicited personal WhatsApp or SMS text messages.
Confirm statutory loan limits and fee transparency: licensed lenders must never demand access to phone contacts or private photos.
Report illegal lenders to Satgas PASTI through email at konsumen@ojk.go.id or by calling telephone hotline 157.
