Grab’s app is better at detecting fraud, experts claim. Gojek disputes this.

Ecommerce platforms in Indonesia have worked on keeping their marketplaces honest as certain merchants gamed their systems. Similarly, ride-hailing apps like Grab and Gojek have had their share of fraud activity.

Photo credit: Afif Kusuma / Unsplash

Earlier this year, Indonesian police arrested eight people in a suburb of Jakarta on the suspicion of creating fake orders and using fake-GPS software. Recently, a GrabFood driver-partner in Jakarta, bought 660,000 rupiah (US$47) worth of food at Burger King, only to find that the order was a sham.

Minimizing fraud would lead to a cleaner gross transaction volume (GMV) – a data point often disclosed by many tech companies – which would mean a better representation of the company’s overall business as well as the market or industry as a whole. Out-of-control fraud could vastly inflate GMV, as was the case with Uber when it expanded to China.

Both Grab and Gojek affirmed the security of their apps through their respective spokespersons. Grab claims that it has “less than a 1% fraud rate” across the region, while Gojek says it has reduced fraudulent trips “by over 90%” after introducing several security updates this year.

When compared side by side, however, the Grab app was able to detect more fraud-related violations compared to the Gojek app, according to a recent Indonesia-focused analysis provided to Tech in Asia in September by experts who requested anonymity. Gojek disputes these findings, stating that it has implemented the same security measures as of this year.

Fake GPS, rooted phones, and modified apps

The security experts explain that there are two main types of fraudsters. The first is made up of garden-variety opportunists who commit fraud on an individual basis to gain certain advantages, such as getting bookings at a faster rate or bypassing account bans that were caused by violations.

The second sort is essentially criminal syndicates, working in groups and employing strategy and technology to reach their objectives. They are after the most lucrative method of illegally profiting from the apps’ cash incentives, which driver-partners normally earn by hitting a certain number of rides or orders.

Essentially, what these scammers do is to create fake drivers or passengers – or both – who undergo enough sham trips to hit the targets needed to qualify for incentives, says the experts.

Tools to commit fraud as well as guides on how to use them are frequently disseminated in groups on chat apps like Telegram (which also gives each user anonymity). Some groups, particularly the more “premium” ones, are invite-only, and both free and paid versions of the tools, especially modified apps are available.

According to the security experts, there are typically four kinds of tools:

1. A fake GPS app. This app, which has features like speed settings and routes, allows fraudsters to fake ride-hailing trips without actually changing their location: i.e., they can be sitting at their desk.
2. A “rooted” Android mobile phone. Similar in concept to “jailbroken” gadgets, a rooted phone would give the user “superuser” access, which allows them to make admin-level modifications to the device.
3. A modified app. This is essentially a version of the Grab or Gojek app that has been modified or hacked by users according to their specifications. It could also help them commit fraud at scale and maximize profit.
4. A Magisk app. Magisk is an app that can conceal “bad” apps from others (e.g. hiding a modified app from the “mother” Grab/Gojek app or Google Play). It’s an extra layer of protection and is typically the most advanced. As such, modified app “packages” that also include Magisk tend to be the most expensive.

Fraudsters may use more than one tool concurrently, but the fake GPS app appears to be the most basic tool, as it doesn’t require much work apart from downloading and installing it on a device. It can also be used in a normal, non-rooted phone.

When scammers use fake GPS, it may appear that the trip started at point A and ended at point B. But when the route is actually traced, it may look nonsensical, observes one expert. For example, the route could have gone diagonally instead of following the roads, cutting into houses and other buildings.

Staying ahead of scammers