Template Gallery

See the phishing lures your team will facebefore attackers do

Six common phishing patterns used against organizations in Indonesia, broken down so your team learns to spot them before the real thing lands.

IT / Helpdesk

IT Password Reset

A fake IT alert warns that your password or account is about to expire, pushing you to click a login link in a hurry.

See the breakdown
Finance

Fake Invoice

An email disguised as an unpaid invoice pressures the recipient to pay quickly to avoid a late fee or service suspension.

See the breakdown
Shipping

Courier Delivery Scam

A message claiming to be from a courier says a package couldn't be delivered and asks for a redelivery or customs fee via a link.

See the breakdown
HR

HR Payroll Update

An email posing as HR asks employees to update their bank or payroll details through a linked form.

See the breakdown
Cloud / M365

Cloud Storage Alert

A fake cloud storage or M365 notification claims a document has been shared or your storage quota is full, leading to a fake login page.

See the breakdown
Banking

Bank Account Verification

An email or SMS claiming to be from a bank warns of a suspicious transaction and asks you to verify your account through a fake login link.

See the breakdown
Government / Tax

Fake DJP Tax Refund Notice

A message impersonating the Directorate General of Taxes (DJP) claims you have a refund waiting or overdue tax to pay, and pushes you to click a link before a deadline.

See the breakdown
Government / Benefits

Fake BPJS Benefit Reactivation Message

A message posing as BPJS Kesehatan or Ketenagakerjaan warns that your benefits will be suspended unless you 'verify' your data through a link.

See the breakdown
Finance / E-Wallet

Fake E-Wallet Account Suspension Alert

A message claiming your e-wallet account is suspended pushes you to enter your PIN or OTP on a fake page to 'restore access'.

See the breakdown
Messaging / WhatsApp

Fake WhatsApp Verification Code Request

Someone posing as a contact or HR asks you to forward the 6-digit code you just received by SMS, which actually hands over control of your WhatsApp account.

See the breakdown
QR / Quishing

Malicious QR Code (Quishing)

A QR code stuck over a parking meter or printed on a fake payment notice leads to a lookalike page that harvests login or card details.

See the breakdown
Payments / QRIS

The QRIS 'Refund' Payment Scam

A seller or 'support agent' sends you a QRIS code and tells you to scan it to receive a refund or claim money, but scanning a QRIS code always sends money out, never in.

See the breakdown
Banking / Social Media

Fake Bank Customer Service on Social Media

You complain about your bank on X or Instagram, and a lookalike 'customer service' account replies offering to help, then asks for your card number, PIN, or OTP to 'resolve' the issue.

See the breakdown
Government / Benefits

Fake Kartu Prakerja Selection Notice

A message claims you have been selected for the Kartu Prakerja program and must pay an activation fee or register on a lookalike site that harvests your NIK, KK, and bank details.

See the breakdown
Government / Recruitment

Fake CPNS Recruitment Offer

A message posing as a recruitment committee offers a guaranteed CPNS position or asks for a fee and personal documents, exploiting the high demand for civil-servant jobs.

See the breakdown
Government / Malware

Fake ETLE Traffic Ticket with Malicious App

A WhatsApp message claims you have an electronic traffic ticket (tilang elektronik) and attaches an APK file to 'view the details', which is actually Android malware that steals your banking data.

See the breakdown
Consumer / Prize Fraud

Fake Prize or Lucky-Draw Winner Notice

A message says you have won a prize in a bank, telco, or brand lucky draw, then asks you to pay a 'tax' or share an OTP to claim it, a prize that never existed.

See the breakdown

These are illustrative examples built for training purposes only, not real messages sent by Claro or any actual organization.

Run these patterns as real simulations

Claro turns each of these lures into a localized, trackable phishing simulation your team can learn from safely.

Request a demo