When a bank fraud case reaches the news, the headline is usually how fast the money disappeared. Behind that, there is almost always a long period of preparation. Two recent cases in Indonesia show this clearly.

In September 2025, police announced that a syndicate had moved about Rp204 billion out of a dormant account at a state-owned bank, in 42 transfers over 17 minutes.1 The planning started months earlier. According to police, the group met in June 2025 and agreed to carry out the transfers on a Friday evening or close to a holiday, to avoid the bank's detection.1 According to PPATK, the five accounts that received the money were opened six days before the transfers.2

In February 2026, a regional bank lost Rp144.82 billion from 6,609 customer accounts. Police say the preparation began in October 2025. Over about four months, at least 45 people were paid Rp5 million each to open bank and crypto accounts, and the login details for those accounts were collected on a single phone.3 When the attack came, the money was spread across dozens of accounts, converted to crypto and sent abroad.

In both cases, the part transaction monitoring could see was the end. Everything before it happened slowly, in small steps that looked ordinary on their own.

What the preparation looks like

This kind of fraud usually takes three kinds of preparation.

The first is learning how the target works: which channels move money, what limits apply, when a transfer triggers extra checks, and when the fewest people are watching. In the first case, even the timing was chosen to avoid detection.

The second is building the accounts that will receive the money. Mule accounts are opened days, weeks or months ahead, often in other people's names, and kept quiet until they're needed.

The third is controlling those accounts, often from a small number of devices. In the second case, the login details for 45 accounts sat on one phone.

Where it shows

Most of this preparation happens outside the bank's core systems, but not all of it is invisible.

One sign is new accounts that are opened and then barely used until they suddenly receive a large amount. The receiving accounts in the first case were flagged for exactly that reason.2 Another is many accounts being accessed from the same phone. A real customer rarely logs into more than one or two accounts from their device. A phone that logs into ten, or forty-five, isn't a customer.

Devices used to study a banking app leave signs too. They are often rooted, are emulators, or have tools attached that let someone watch and change what the app does. When those devices also touch accounts that later receive stolen money, that link is worth knowing before the attack, not after.

What this means

Banks are good at catching the moment money moves. They're usually less prepared for the weeks before, when the signs are small and spread across accounts and devices. Reviewing those signs regularly, and connecting devices to accounts, gives the bank a chance to act while the attack is still being prepared.

Questions for your team

  1. Would you know if one phone was used to log into dozens of different accounts?
  2. Do you watch accounts that are opened and then barely used, before they receive their first large transfer?
  3. After a fraud case, can you trace back when the receiving accounts, and the devices behind them, first appeared?
  4. Do you know which devices are studying your app, and which accounts they touch?

Where MoSecure fits. MoNetra keeps a history of each device and the accounts it touches, flags phones used to register several accounts, and lets investigators trace back from a blocked case to the devices and activity connected to it. MoTogu detects rooted devices, emulators and hooking tools while your app runs, and reports them to a dashboard your team can review. Neither sees inside your core banking system, but together they cover the devices where much of the preparation happens.

Sources

  1. Antara, 25 Sep 2025: Polri says dormant-account syndicate moved Rp204 billion in 17 minutes
  2. CNN Indonesia, 25 Sep 2025: PPATK says receiving accounts were opened six days before the breach
  3. AFU, 16 Jul 2026: Hacker network breaches regional bank, Rp144 billion in customer funds stolen

Figures are as reported by the sources above at the time of writing. Spotted an error? Email contact@mosecure.id and we will correct it.