Already been scammed? What to do in the first hour

What happened

Pak Anton, who runs a kafe, transferred Rp4.5 million to a "coffee bean supplier" that turned out to be fake. Twenty minutes later he realised: the number was no longer active.

He felt angry and embarrassed at once. But Pak Anton didn't waste time. He called his bank, opened iasc.ojk.go.id and got his evidence together. There was no guarantee the money would come back, but every minute he saved improved his chances.

If this happened to you: you are not stupid. Scammers work full time at making people trust them. What matters now is the order of the steps.

Why speed matters

Scammers move money within minutes. OJK, Indonesia's financial services authority, asks victims to report within the first 10 minutes, while the average victim in Indonesia reports only about 12 hours later. By then the money is usually hard to trace.

The Indonesia Anti-Scam Centre (IASC) was set up by OJK with Satgas PASTI and the financial industry on 22 November 2024. IASC can delay transactions, block accounts linked to scams and try to return victims' remaining funds. By mid-January 2026 it had received more than 432,000 reports and returned Rp161 billion to 1,070 victims. Reporting doesn't guarantee your money comes back, but without a report there is almost no chance.

Get these ready

• Proof of transfer. It is required for an IASC report.
• Screenshots of the chat with the scammer, their name and number, and the platform where you met them.
• Account details: your bank and account number, and the recipient's bank and account number.
• Timeline: the date, time and amount of every transfer, in order.
• Your KTP (ID card) number and a photo of it, your address, phone number and email.

The first hour: in this order

1. 1Call your bank right now on the official number on the back of your ATM card. Explain what happened and ask them to block your card, account or app access if your details leaked too.
2. 2Report at iasc.ojk.go.id. OJK stresses that reports go only through this official site. Your bank can also pass your report to IASC. One form covers one recipient account, so transfers to several accounts need several reports.
3. 3File a police report. Since 14 January 2026 a police report can be made directly in the IASC system, or at your nearest police station. A police report is needed before banks can return remaining funds.
4. 4Keep the report numbers from IASC and the police. Only your own bank will contact you about getting money back.
5. 5If an account was taken over, secure it now. For WhatsApp: register again with the 6-digit SMS code so every other device is logged out. Changing the password alone is not enough. For a Google account: change the password, remove unknown devices and turn on 2-Step Verification.

After that

1. Report the scammer's number at aduannomor.id (Komdigi, the communications ministry). Verified reports are passed to the operator to block the number.
2. Report the scammer's social media accounts, websites or apps at aduankonten.id (Komdigi), with the link and screenshots.
3. The recipient's account can be reported at cekrekening.id (Komdigi). On the same site you can also check an account before transferring next time.
4. Tell family, staff and customers if your account was used by the scammer, so they aren't fooled in your name.
5. Watch out for a second scam. The police state that online fraud complaints are not handled through WhatsApp numbers, and OJK warns of fake websites and people posing as IASC staff. Anyone who promises to recover your money for a fee is a scammer.
6. For questions, contact OJK on 157, WhatsApp 081-157-157-157, or konsumen@ojk.go.id.