Scam playbook

What your staff and customersare actually being hit with

A working reference on the scams circulating in Indonesia right now, written for security teams who have to brief employees and answer customer questions. Each entry breaks down how the scam runs, the signals that give it away, and the one rule that stops it.

Mobile malware / WhatsApp

The Malicious APK Sent Over WhatsApp

A file arrives on WhatsApp looking like an invitation, a delivery receipt or a tax notice. Installing it hands an attacker your SMS, your notifications and often your banking access.

Read the breakdown
Incident response / mobile

You Already Installed It: What To Do Now

The steps that matter in the first hour after installing a malicious APK, in the right order, and the mistakes that make the damage worse.

Read the breakdown
Mobile malware / social

The Wedding Invitation That Is Not An Invitation

The single most successful disguise for a malicious APK in Indonesia, because a wedding invitation from an unknown number is socially plausible rather than suspicious.

Read the breakdown
Voice / vishing

Phone Scams: Fake Police, Tax and Courier Calls

A caller claiming authority, a problem only they can solve, and pressure to act while still on the line. The technique has a name: vishing.

Read the breakdown
Payments / e-wallet

The Wrong Transfer Setup

Money you did not expect arrives, followed by someone asking for it back. Returning it directly is the trap, and it often connects to an illegal loan taken in your name.

Read the breakdown
Recruitment / social

Fake Job Offers and Recruitment Fraud

An offer arrives for a role you did not apply for, from a company name you recognise. The pattern ends in a fee, a data harvest, or a money-laundering role.

Read the breakdown
Response / reporting

How To Report Online Fraud in Indonesia

Which channel to use, in what order, and what evidence to gather first. Reporting fast to the right place is what determines whether funds can still be held.

Read the breakdown

These pages describe fraud tactics for defensive awareness and staff briefing purposes. They are general information, not legal or financial advice. If you have lost money, report it through official channels: the police cyber crime unit, your bank, and for investment or lending matters, OJK.

Turn awareness into measured behaviour

Reading about scams does not change what people click. Claro runs bilingual simulations across email, WhatsApp, SMS and voice, then measures who is actually resilient.

See how Claro measures it