Indonesian Police Uncover Crypto-Funded Phishing Scam Targeting E-Ticket Buyers
Jakarta – Indonesian National Police have dismantled a sophisticated online fraud operation that utilized SMS phishing to target individuals purchasing electronic tickets, with illicit proceeds funneled through cryptocurrency. The operation, controlled by Chinese nationals, involved five Indonesian accomplices who received compensation in USDT, a stablecoin pegged to the US dollar.
Details of the Scam
The Cyber Crime Directorate of the Indonesian National Police’s Criminal Investigation Unit (Bareskrim Polri) arrested five suspects identified as WTP (29), FN (41), RW (40), BAP (38), and RJ (29). Investigators discovered the scheme was directly orchestrated by individuals in China using Telegram accounts under the aliases Lee SK and Daisy Qiu.
According to Brigadier General Himawan Bayu Aji, Director of Cyber Crime at Bareskrim Polri, the Indonesian suspects played various roles in the operation. WTP operated the SMS blasting device starting in September 2025, while FN provided SMS blast services and managed SIM cards beginning in July 2025. RW assisted FN with SMS blasting operations, similarly starting in July 2025. BAP operated a separate SMS blasting device from February 2025, and RJ supplied registered SIM cards to the other actors.
Modus Operandi
The Chinese controllers provided the Indonesian suspects with SIM boxes – devices capable of sending a large volume of SMS messages – and remotely managed the system. Suspects in Indonesia were tasked with inserting SIM cards into the boxes and monitoring the operation through a Terminal Vendor System (TVS) application. The system could send phishing SMS messages to approximately 3,000 mobile phone numbers daily, relying on hundreds of SIM cards registered using Indonesian citizen data.
The scam unfolded when victims received SMS messages falsely claiming a bill for traffic violations, including a link to a fraudulent e-ticket website that closely resembled the official site of the Indonesian Prosecutor’s Office. Victims who entered their personal and credit card information on the fake website had approximately 2,000 Saudi Arabian Riyals (equivalent to IDR 8,800,000) illegally debited from their accounts.
Police identified 124 additional phishing website links and six additional phone numbers used to distribute the fraudulent SMS messages.
Cryptocurrency Payments and Profits
The Indonesian suspects were compensated monthly in USDT, ranging from 1,500 USDT (approximately IDR 25 million) to 4,000 USDT (approximately IDR 67 million) depending on the number of SIM boxes operated.
BAP received the largest profit, totaling 53,000 USDT (approximately IDR 890 million) from February 2025 to January 2026. RW received 42,300 USDT (approximately IDR 700 million) between June 2025 and January 2026, while FN received 14,100 USDT (approximately IDR 235 million) from July 2025 to January 2026. WTP earned 32,700 USDT (approximately IDR 530 million) through 43 transactions from September 2025 to January 2026. These profits were routinely converted into Indonesian Rupiah.
Legal Consequences
The five suspects face charges under Article 51 in conjunction with Article 35 of Law Number 1 of 2024, amending Law Number 11 of 2008 concerning Information and Electronic Transactions, as well as Article 45A paragraph 1 in conjunction with Article 28 paragraph 1 of the same law. They may also be charged under Articles 3, 4, 5, and 10 of Law Number 8 of 2010 concerning the Crime of Money Laundering, and Articles 607 paragraph 1 letters a, b, and c of Law Number 1 of 2023 concerning the Criminal Code in conjunction with Article 20 letter c of the same law. The maximum penalty for these offenses is 15 years imprisonment and a fine of IDR 12 billion.