In May 2026, OJK reported that 93 financial institutions had compensated consumers a total of Rp22.89 billion through April.1 Four months later, the figure for January to August stood at Rp77.26 billion, paid by 146 institutions.2

Those numbers cover every kind of consumer complaint, not only scams. But the direction is clear: more institutions are paying, and they are paying more.

OJK can now go to court

Since 22 December 2025, POJK 38/2025 has allowed OJK to file lawsuits against financial institutions on behalf of consumers who were harmed, at no cost to the consumer. Any compensation won goes to the people who suffered the loss.3

This doesn't change who is at fault in any particular case. It changes what happens when a consumer believes the institution is at fault: they no longer need the money or the energy to sue. The regulator can do it for them.

Meanwhile, scam volume keeps growing

By 31 August 2026, the Indonesia Anti-Scam Centre had received 668,441 reports, blocked Rp771.2 billion in victims' funds and returned Rp206 billion to victims.2 Every one of those reports is a customer who may, sooner or later, ask their bank one question: why did you let this happen?

Where the region is heading

Indonesia's neighbours have already answered part of that question.

  • Malaysia. E-wallet providers must refund scam victims within seven working days if they failed to meet Bank Negara Malaysia's anti-scam standards, even where the customer was partly negligent. Where both sides share the blame, compensation follows the degree of fault. The standards include stronger transaction authentication, cooling-off periods for high-risk transactions, verifying accounts to a single device, a scam hotline and a kill switch.4
  • Singapore. Under its Shared Responsibility Framework, banks and telcos share the losses from phishing scams when they fail specific duties.5

We are not predicting that Indonesia will copy either model. But both point in the same direction: liability follows the controls an institution did or didn't put in place.

The question is changing

For years, the default answer in a scam dispute was that the customer shared their OTP, installed the app or clicked the link, so the loss was theirs. That answer is getting harder to rely on, for two reasons:

  1. Customers can now escalate cheaply, and the regulator can sue.
  2. Regulators in the region judge institutions by their controls, not only by what the customer did.

So the question a bank should prepare for is no longer only “was the customer careless?” It is: what did your systems see, what did they decide, and was that reasonable?

What reasonable controls look like on mobile

Malaysia's list is a useful mirror, because almost every item happens on the customer's phone:

  • Binding accounts to a known device, and treating a new device as a risk event, not a formality.
  • Authentication matched to risk: stronger checks for risky actions, not the same OTP for everything.
  • Cooling-off for high-risk transactions, such as a large transfer to a new recipient straight after a password change.
  • Knowing when the device or app can't be trusted: remote control, a modified app, malware, an active call during a transfer.

The evidence problem

When a dispute arrives, transaction logs show what happened: the amount, the time, the recipient. They rarely show the conditions it happened under. Was the genuine app being used? Was the phone being controlled remotely? Was the customer on a call while authorising the transfer? Was this the customer's usual device?

Without that evidence, an institution argues from half the picture, whichever way the facts actually fall. With it, the institution can show the controls it applied and why it decided what it did, or find out early where its controls fell short.

Questions for your team

  1. If a transfer came from the customer's own registered phone with the correct PIN and OTP, what in your logs separates the customer doing it from malware controlling the phone?
  2. When the transfer was approved, would you know if the screen was being driven through an accessibility service, covered by an overlay or shared, or if a phone call was active?
  3. Can you show that the transfer request came from your genuine app, not a modified copy or a clone running in a hidden profile?
  4. Did the device's condition shape the decision at the moment of the transfer, or is it only looked up after the customer complains?
  5. Would that decision record stand up in front of a third party, for example because it can't be altered after the fact?

Where MoSecure fits. MoNetra checks the device, app and session at login, device binding and transfer, returns ALLOW, STEP-UP or BLOCK with reason codes, and keeps a signed record of each decision, so your team can show what was seen and why it acted. MoTogu makes sure the app those decisions rely on is genuine and untampered. They don't replace your judgement in a dispute; they give you the evidence to support it.

This article describes regulations and figures for information only and is not legal advice.

Sources

  1. Bareksa, 6 May 2026: OJK issues 79 sanctions to financial institutions; consumer compensation reaches Rp22.89 billion
  2. Infobanknews, 7 Sep 2026: OJK asks financial institutions to compensate consumer losses of Rp77.26 billion
  3. Bisnis.com, 20 Jan 2026: OJK can now sue financial institutions over consumer losses
  4. IDN Financials, 3 Jul 2026: Malaysia requires e-wallets to compensate scam victims
  5. Herbert Smith Freehills Kramer: Financial institutions and telcos required to share responsibility for phishing scams in Singapore

Figures are as reported by the sources above at the time of writing. Spotted an error? Email contact@mosecure.id and we will correct it.