Indonesian banks step up cybersecurity after $11.9m payment fraud

Indonesian banks are increasing cybersecurity measures after a 200 billion rupiah (US$11.91 million) fraud incident involving BI Fast, the country’s national retail payment system.

The Financial Services Authority (OJK) has launched inspections of regional banks, focusing on digital security, and directed banks to strengthen risk management, fraud detection, and customer transaction analysis.

OJK is coordinating with Bank Indonesia (BI) and law enforcement to address the case, which officials suspect was carried out by an organized crime group.

OJK noted concerns that stolen funds may have been transferred to international cryptocurrency assets, complicating recovery efforts.

BI maintains that BI Fast is operated according to national security standards, but emphasized that all participating banks must ensure robust internal controls.

BI has instructed banks involved in the fraud to tighten security and is monitoring the situation as authorities investigate.

Both OJK and BI have called for global action against cybercrime, citing the need for international cooperation.

🔗 Source: Bisnis.com

🧠 Food for thought

Implications, context, and why it matters.

Fraud likely hit bank-side controls instead of BI Fast

In the Rp200 billion case tied to BI Fast, investigators have not confirmed whether attackers hit the payment rails (the underlying network) or exploited weak bank controls like account takeover or money mule rings (people recruited to move stolen funds).
Bank Indonesia says BI Fast follows national security standards, which steers focus to gaps in banks’ fraud checks and customer authentication.
OJK is auditing regional lenders with emphasis on digital security and transaction review, which suggests internal control issues at some participants rather than the central rails.
The crime group moved Rp200 billion before detection, exposing gaps in real-time monitoring that dovetail with OJK Regulation 12/2024 (issued in 2024) on enterprise anti-fraud programs across financial institutions 1.

Vendors should track potential OJK rulemaking on real-time payment security

Anti-Money Laundering (AML) and fraud vendors may see faster rulemaking as OJK could add circulars or tighten POJK 11/2022 to require defined controls for real-time payment users, echoing Circular Letter 29/2022 on testing plus incident reporting 2.
Technology providers should watch draft POJK (OJK regulations) or SEOJK (Surat Edaran OJK or OJK circular letters) on real-time payments, since banks may need monitoring or anomaly detection or multi-factor authentication if new rules land.