Scam chats are tidy now: typos are no longer a sign

What happened

Bu Lestari owns a batik boutique. One morning a message came from a new number: "Good morning Ma'am, we are from the procurement team of a company. We would like to order 120 batik shirts for an event. Our size list and purchase order are attached. Please confirm today."

Polite, no typos, and a big order. But the attachment was called "PO_Batik.apk". Bu Lestari knew a size list is never an app. She didn't open it and asked the sender to send the list as plain text. The number never replied.

What has changed?

The FBI notes that AI helps criminals fix the mistakes that used to warn us of fraud, such as poor grammar. Kaspersky also says AI models make fake emails, messages and websites convincing, to the point that the language mistakes that used to expose scams have almost disappeared.

So the question is no longer "is the language tidy?" but "what is this message asking for?" The most dangerous thing is an APK file: an Android app file. According to BSSN, Indonesia's cyber agency, an APK disguised as a wedding invitation can give criminals access to the victim's text messages, including codes from the bank. Bank Mandiri lists other disguises such as "tax" files, and BRI warns that APK malware can steal data and take over the phone.

Warning signs

• An attachment ending in .apk, whatever it is called: an invitation, a parcel receipt, a traffic ticket, a bill, an order list or a photo.
• The sender claims to be a courier, the police, the tax office, a bank or a big company, but uses a personal number.
• A sudden big order with pressure to confirm or open a file today.
• You are asked to click a link to "verify", "claim a prize" or "check status".
• An official letter arrives on WhatsApp. For example, official electronic traffic tickets are sent by post, not WhatsApp.

Rules for your shop

1. 1Never open an .apk file from a chat. Install apps only from the Play Store or App Store.
2. 2The shop phone has its own rule: staff never open files or links from unknown numbers, whatever the reason. If in doubt, they ask you first.
3. 3Confirm big orders by phone or through the company's official channels, not through the number that contacted you.
4. 4Ask for order details as plain text or an ordinary photo. Real buyers don't mind.
5. 5Turn on transaction notifications in your bank app so money leaving without permission is spotted quickly.

If it already happened

1. If you already installed an APK file: turn off mobile data and Wi-Fi right away, then delete the app.
2. From another phone or computer, change the PIN and passwords for mobile banking, email and WhatsApp. Call your bank on its official number, for example BRI on 1500017.
3. If needed, reset the phone to factory settings. BRI recommends this for a phone that has a harmful APK installed.
4. Block the sender, keep screenshots, and report to the Indonesia Anti-Scam Centre at iasc.ojk.go.id if money was lost.

Full steps for the first hour: Already been scammed?