In July 2026, PPATK, Indonesia's financial transaction reports and analysis centre, published new findings on how online gambling networks move money. The headline numbers went down: gambling turnover fell from Rp359.81 trillion in 2024 to Rp286.84 trillion in 2025. But PPATK's head warned that a drop in value should not breed complacency: transactions were becoming more frequent, smaller, and spread across more complex channels, a sign that the networks are adapting.1

That adaptation has a name in security: camouflage. Instead of hiding a few large, suspicious transactions, a network produces thousands of small ones that each look like ordinary activity.

What camouflage looks like

PPATK's findings describe four patterns:12

  • Small, frequent, spread-out transactions. Money moves in amounts that resemble everyday payments, not in single large transfers.
  • Many-to-one and one-to-many flows. Funds pass through nominees and affiliated accounts, obscuring who actually controls and benefits from them.
  • Disguised as normal trade. Shell companies, fictitious small businesses and digital merchants, including sub-merchants under aggregators, make deposits look like sales. QRIS accounted for 88.6% of gambling deposit transactions in the first quarter of 2026. PPATK stresses that the problem is misuse, not QRIS itself.
  • Accounts with a clean past. Accounts bought or rented from other people, dormant accounts taken over, and onboarding passed with fake e-KTP or deepfakes. PPATK said more than 28,000 accounts used for gambling deposits in 2024 came from account trading.3

Why this matters beyond gambling

These findings concern gambling money, but the infrastructure is shared. The same bought, rented and borrowed accounts that receive gambling deposits are also used to receive money from scams. As of 31 May 2026, the Indonesia Anti-Scam Centre had received reports on 998,558 accounts linked to fraud, and had blocked about half of them.4 A network that has learned to look ordinary for one purpose can look ordinary for another.

Why transaction-only monitoring struggles

Most fraud and anti-money-laundering monitoring starts from the transaction: amount, frequency, recipient, timing. Camouflage is designed against exactly that view.

  • Each transaction passes on its own. A small QRIS payment to a registered merchant is, by itself, unremarkable.
  • The account history looks clean. An account opened years ago by a real person and used normally does not look like a mule account, until it suddenly behaves like one.
  • The pattern only exists in aggregate, across many accounts and merchants, and often becomes visible only after the money has moved on.
  • Volume creates its own problem. Tightening rules to catch small transactions also catches thousands of legitimate customers, and investigation teams have limited time.

None of this means transaction monitoring is wrong. It means it is not enough on its own when the other side is deliberately producing normal-looking transactions.

What is harder to disguise

Amounts can be made small. Merchants can be made to look legitimate. Account history can be bought. What is much harder to change at scale is what sits behind the transactions:

  • The device. One phone operating many unrelated accounts, emulators instead of real phones, and cloned or modified apps all look different from genuine customers, whatever the transaction amounts.
  • The app and the session. Whether the request came from the genuine, untampered app, and whether the session shows signs of automation or remote control.
  • The relationships. The same device, network or location appearing behind many accounts or merchants that should have nothing to do with each other.
  • The change of hands. A long-standing account that suddenly appears on a new device, or on a device already linked to other accounts, is often the moment a clean account becomes a mule.

Camouflage targets the transaction layer. Evidence from the device and the session is a different layer, and a much harder one to fake at volume.

What may come next: poisoning the model

There is a further step that researchers have studied but that, as far as we know, has not been publicly reported in Indonesia: deliberately poisoning fraud models. If a detection model learns what normal looks like from past transactions, an attacker who can feed it enough carefully shaped, normal-looking activity may gradually shift what the model accepts. Peer-reviewed research on banking fraud detection has shown this is feasible.5

We include this not as a current threat report but as a design principle: a model should not be the only line of defence, and it should not learn only from transaction outcomes. Independent evidence that an attacker cannot shape as easily, from the device, the app and the session, keeps the system honest even if one layer is being gamed.

Questions for your team

  1. Can you see when one device is behind many accounts, or behind both a customer account and a merchant account?
  2. When a long-dormant or long-standing account becomes active on a new device, does that change its risk?
  3. Do your rules for small, frequent transactions combine transaction data with device and session evidence, or rely on amounts and counts alone?
  4. If your fraud model retrains on recent activity, what stops a sustained run of normal-looking fraud from becoming the new normal?
  5. How quickly do findings from investigations, such as confirmed mule devices and accounts, feed back into real-time decisions?

Where MoNetra fits. MoNetra adds the layer that camouflage doesn't reach. At login, device binding and transfer, it checks whether the app is genuine, whether the device and session can be trusted, and how that device relates to others, including one device used across many accounts. It returns ALLOW, STEP-UP or BLOCK with reason codes your team can explain. It doesn't replace transaction monitoring or AML screening; it gives them evidence the transaction alone can't provide.

Sources

  1. Bisnis.com, 23 Jul 2026: PPATK reveals new online-gambling laundering methods, now relying heavily on QRIS
  2. JawaPos, 25 Jul 2026: PPATK says online-gambling laundering is growing more complex, using deepfakes and fake e-KTP
  3. Infobanknews, 28 Jul 2025: Banks brace against dormant-account fraud
  4. Kontan, 30 Jun 2026: IASC received 579,459 fraud reports as of May 2026
  5. Paladini et al., ACM Transactions on Privacy and Security, 2023: Fraud Detection Under Siege: Practical Poisoning Attacks and Defense Strategies

Figures are as reported by the sources above at the time of writing. Spotted an error? Email contact@mosecure.id and we will correct it.