Indonesia’s banks need faster fraud decisions as digital payments grow

More payments to process and customer behaviour to interpret means less time to spot when something looks wrong.

Indonesia’s digital payments market is heading to another year of rapid growth. In the first quarter of 2026, Bank Indonesia recorded 14.82 billion digital payment transactions, up 37.69% year-on-year (YoY). QRIS transaction volume grew 116.43%, whilst BI-FAST processed 1.4 billion retail transactions.

For banks, that means more payments to process, more customer behaviour to interpret and less time to spot when something looks wrong.

That growth also gives criminals more room to move. A payment can look authorised, clear the bank, and pass through another account, wallet or cash-out route before the concern is raised. Once money has gone, the bank is left with the difficult part: Explaining what it saw, what it missed and why the payment was allowed to continue.

Customers want a quick answer, fraud teams need to trace where the funds went, and regulators may ask whether the warning signs were available earlier.

Left too late, a single scam case can become a loss event, a complaint, a reputational issue, and a question about the bank’s wider control environment.

Customer trust has become the attack route
Indonesia’s scam figures show how far fraud has moved into everyday digital life. Two-thirds of Indonesian adults say they have encountered a scam, and more than a third have fallen victim, with estimated losses reaching Rp49t ($3.513b).

Criminals are targeting people in the places they already use: Direct messages, SMS, social media, online marketplaces, and fake websites. A seller looks genuine. A message appears to come from a trusted organisation. A request arrives with urgency. By the time the payment instruction reaches the bank, the customer may already believe the transaction is legitimate.

This changes the job fraud teams have to do. Rather than looking only for stolen credentials or unusual transaction values, they need to recognise when a genuine customer is being guided into a bad payment. The warning signs can sit around the transaction rather than inside it: A new payee, a changed device, unusual timing. or links to other suspicious accounts.

Customer education helps, but it only goes so far. Scammers rely on timing, pressure, and familiarity, and even experienced digital users can approve a payment that feels legitimate at the time.

Regulators will ask what the bank could see
Indonesia already has a clear anti-fraud framework. POJK 12/2024, issued by OJK, Indonesia’s Financial Services Authority, requires financial services institutions to apply an anti-fraud strategy across prevention, detection, investigation, reporting, sanctions, monitoring, and evaluation.

The growth in scam reporting now puts those requirements into a more practical setting. The Indonesia Anti-Scam Centre began operating in November 2024, and by January 2026, Rp161b ($11.543b) had been returned to 1,070 scam victims. Recovery work is valuable, but every case that reaches that stage has already created pressure for the customer, the bank, and the wider payment system.

Once a suspicious payment is reviewed, the questions become specific. What could the bank see at the time? Was the device familiar? Was the beneficiary new? Has the customer’s behaviour changed? Had the receiving account appeared in other cases?

Those questions are difficult to answer when fraud-detection signals span separate products and teams. A mobile banking event, a transfer review, an ATM cash-out, and a customer complaint can each reveal part of the picture. But if those details only come together after the money has moved, the bank is left explaining the gap.

Fraud controls need to work at payment speed
By the time a customer has called to report a scam, the bank is already working backwards. Teams are tracing the funds, checking the receiving account, reviewing the customer journey and looking for links to earlier cases. In fast payment environments, that is a difficult place to start.

The better position is to intervene whilst the payment is still in reach. Fraud teams need systems that can raise the right cases quickly, give analysts the evidence they need and support a decision before the money moves again.

Customers still expect payments to work first time. A banking app, QR payment or wallet transaction cannot feel like a fraud investigation. The job is to keep genuine payments moving and give the bank a clean way to step in when behaviour looks wrong.

Technology helps when it sharpens the decision. Real-time monitoring, behavioural analysis and machine learning should help teams decide which cases need attention first, what evidence supports the alert and how the case should be handled.

Indonesian banks already run complex payment environments across cards, mobile banking, ATMs, wallets and instant transfers. Fraud management has to work across those environments with limited disruption. The institutions that get this right will be better placed to protect customers, meet regulatory expectations and keep digital payments moving with confidence.

Connected fraud management is the next step
Bank Sinarmas, a commercial bank based in Jakarta shows what connected modernisation can involve. The bank moved from legacy technology to a more unified payment platform covering switching, card management, ATM management and fraud management. It also connected with local switches and supported scheme certification, giving the bank a stronger base for new services, channel growth and transaction security.

The security gain comes from connection. When the systems handling payments, cards, ATMs and fraud sit closer together, the bank has a better chance of seeing suspicious behaviour across channels. With Sinarmas, cardless withdrawal functionality also helped reduce ATM fraud attempts because cards could not be skimmed.

The same issue is now being addressed at network level through work with Jalin, Indonesia’s national payment switching company. The focus is on strengthening fraud detection and prevention across digital payment transactions, so institutions connected to the network can monitor risk in real time, investigate cases faster, and apply controls more consistently as volumes rise.

Digital payments in Indonesia have earned their place in everyday life. The banks and payment institutions that protect the next stage of growth will be the ones that can see risk early, act quickly, and explain every decision.