How to Report Cybercrime in Indonesia: Police, Kominfo, BSSN, and Banks

You just lost money to phishing. Or your Instagram got taken over and used to borrow money from friends. Or someone uses your photo for illegal content. Where do you report?

Many victims get confused because Indonesia has several cybercrime reporting channels, each with different function. This article maps correct reporting flow, from first level at bank to police and Kominfo, with ready documents so your report does not bounce.

Map of cybercrime reporting channels in Indonesia

Understand function difference so you go to right door.

Police - Cyber / SPKT / Patrolisiber.id. For criminal acts. Online fraud, account hacking, photo extortion, data theft. This path can process criminal case and block destination account via investigation.

Kominfo - aduankonten.id and cekrekening.id. For content blocking and fraud account flagging. Kominfo does not process criminal case, but can take down websites, social accounts, and put accounts into blacklist.

BSSN - Cyber Complaint Center. For critical sector cyber incidents, massive malware, and technical consultation. BSSN does not handle individual fraud $150, but provides mitigation guidance and coordination if case has wide impact.

Banks and e-wallets. To hold funds and block destination account. Banks need police report and fast chronology.

OJK and AFPI. For illegal lending apps, threatening collection, and fake loans under your name.

Platforms (Meta, Google, TikTok, Shopee). For takedown of fake accounts and recovery of your account.

You often need more than one channel. Fraud of $500 needs bank report plus police plus Kominfo.

Step 0: Save evidence before reporting anywhere

Do not delete chat. Save evidence first per digital evidence guide.

Within first 30 minutes do:

Record screen chat from start to end.
Screenshot transfer proof with reference number.
Copy actor profile link and archive via web.archive.org.
Save WHOIS domain if fraud via website.
Create timeline with time: when you saw ad, when you transferred, when actor vanished.

Without neat evidence, every channel will ask you to come back to complete.

Name evidence folder Cyber_Report_20260715_VictimName and backup on laptop plus private Drive.

Step 1: Contact bank or e-wallet within 1 hour

Speed is key for chance to hold funds.

If bank transfer:

Contact your bank call center: BCA 1500888, Mandiri 14000, BNI 1500046, BRI 14017, BSI 14040.
Say: you are victim of online fraud, ask help to block or hold funds to destination account.
State: reference number, amount, transfer time, destination account owner name.
Ask for bank complaint ticket number.

Then contact destination bank if you know it. Destination bank needs police report basis, but initial report can be done via call center.

If using QRIS:

Save Merchant ID, merchant name, and transaction ID.
Contact QRIS provider (GoPay, OVO, Dana, ShopeePay) via in-app CS. Attach transfer proof and timeline.

If actor uses e-wallet:

Send email to e-wallet CS: support@dana.id, cs@ovo.id, hello@gopay.co.id with subject Urgent Fraud - Transaction ID XXX.
Attach timeline, screenshot, and ID.

Banks usually say they need police report within 24 hours for formal blocking process. Tell them you will complete police report same day.

Step 2: Report to Police - choose offline or online path

Offline path - come to office (recommended for cases above $350 or important account hacking)

Go to Police Front Desk SPKT at Polres or Polda or Bareskrim for big cases. Bring:

Original ID plus 2 photocopies
Written timeline 1-2 pages with time
Printed transfer proof and key screenshots (max 10 pages)
Flashdisk containing original files
Rp10.000 duty stamp (some Polres ask for statement letter)

At SPKT, say: "I want to report alleged criminal act of online fraud / account hacking / extortion."

Officers will create Police Report (LP). Make sure you get LP number, investigator name, and cyber unit contact.

Ask whether further examination needed at Cyber Crime Investigation Unit. Some Polres direct you to special unit after SPKT.

Online path - Patrolisiber.id

Open https://patrolisiber.id. Site managed by Police Criminal Investigation Agency.

Create account with national ID and active email.
Choose category: Online Fraud, Hacking, Pornography, etc.
Fill timeline with time format.
Upload evidence: watch file size limit, compress if needed but keep originals in Drive.
Submit and save complaint number.

Patrolisiber fits for initial report and digital trail. For cases with big loss, still come offline to speed process.

What happens after LP issued

Investigators will do initial verification. If criminal element meets, it enters investigation stage. At this stage investigators can request data to banks (destination accounts), providers (owner of number), and platforms (IP log).

Investigation time varies. Cases with complete evidence and clear loss usually prioritized. You can ask progress every 14 days with LP number.

Do not contact actor again after reporting. Contact again can be seen as obstructing investigation or giving actor chance to delete trail.

Step 3: Report to Kominfo for content and account blocking

Kominfo has two main channels.

Cekrekening.id - for fraud accounts

Open https://cekrekening.id.

Choose Report Account.
Fill actor account data: bank, account number, owner name, fraud category.
Upload transfer proof and chat screenshot.
Enter brief timeline.

Your report will be verified and enter database. Database used by banks, marketplaces, and e-wallet providers to detect problematic accounts. Your report helps other victims.

Aduankonten.id - for website, fake account, and illegal content

Open https://aduankonten.id.

Create account.
Choose category: Fraud, Gambling, Pornography, etc.
Enter link of website or social media account of actor.
Upload evidence screenshot.
Submit.

Kominfo will forward to platform for takedown. Takedown process 1-7 days depending on platform and evidence completeness.

If content uses your photo without permission, choose category Negative Content Harmful. Include evidence you own original photo.

Step 4: Report to platforms for takedown and account recovery

Each platform has recovery path.

Instagram / Facebook (Meta):

For taken over account: open https://www.instagram.com/hacked or https://www.facebook.com/hacked. Follow identity verification.
For fake account using your photo: open fake profile > three dots > Report > Pretending to be someone > Me.

Google:

If fraud site uses Blogspot or Google Sites: Report via https://safebrowsing.google.com/safebrowsing/report_phish/
If your data appears in Google Search: request removal via https://support.google.com/websearch/troubleshooter/9685456

TikTok:

Open actor profile > Share > Report > Fraud and Scam.

Shopee / Tokopedia / Lazada:

Report store via Report menu in app. Choose Fraud category. Attach order number.

Include LP number in platform report for faster process. Platforms more responsive if official document exists.

If your case is illegal lending or fake loan under your name due to leaked ID:

Check lending legality in OJK: https://www.ojk.go.id or OJK WhatsApp 081-157-157-157.
If illegal, report via https://www.lapor.go.id or satgaspasti email.
If legal loan but collection uses threat to spread data, report to AFPI: https://www.afpi.or.id and OJK 157.
Request OJK credit report via iDebku to see loans under your name.

Save billing evidence: phone recordings, threat screenshots. Do not delete.

Step 6: Report to BSSN if incident widespread or need technical guidance

BSSN handles national scale cyber incidents, not individual $150 case. But BSSN helps if:

Your small business website defaced massively and used to spread malware.
You manage system with thousands customer data leaked.
You need ransomware mitigation guidance for small office.

Open https://www.bssn.go.id or email BSSN cyber complaint. BSSN can coordinate with Kominfo for recovery.

For individuals, BSSN has hardening guides you can use as report reference.

Report template that gets accepted fast

Use this template for all channels for consistency.

CYBERCRIME REPORT - ONLINE FRAUD
Reporter: Name as ID
ID: ...
Address: ...
Phone: ... (active WA)
Email: ...

Timeline:
- 2026-07-15 08:15 - Saw cheap phone ad on Instagram @cheap_shop99
- 2026-07-15 08:20 - Chat via WA 62xxx with actor
- 2026-07-15 08:45 - Transfer $350 to BCA 1234567890 under R. S. Ref ID 123456
- 2026-07-15 09:00 - Sent transfer proof, actor promised receipt
- 2026-07-15 10:15 - IG account gone, WA single check

Loss: $350, method BCA Mobile transfer
Actor account: BCA 1234567890 under R. S.
Actor accounts: IG @cheap_shop99 (archive: https://web.archive.org/...)
Actor phone: 62xxx

Evidence attached:
1. Chat screen recording (mp4, 2 min)
2. Sequential chat screenshots (6 files)
3. Transfer proof PDF plus CSV mutation
4. Archive link of actor profile
5. WHOIS domain if any
6. Full timeline

Request: Block actor account, criminal process for fraud, takedown account.

Regards,
[Name]
Date

Template like this eases officers because key data exists in first page.

Tips for fast processing

Come morning. SPKT quiet 08.00-09.00. Officers more focused.

Bring neat evidence in folder. Clear folder with label helps. Do not bring only phone and ask officer to scroll. Officers respect victims who prepared concise print plus flashdisk.

Use factual language, not emotional. Write time, amount, account name. Avoid long rant without data.

Do not duplicate reports with different data. Duplicate reports with different stories confuse investigators. One consistent report better.

Follow up polite every 14 days. Ask progress with LP number. Do not call every day. Investigators have many cases load.

Save all ticket numbers. Bank ticket number, Kominfo complaint number, patrolisiber number, and police LP. Note in one sheet.

Mistakes that make report rejected or slow

Report without transfer proof. Bank needs reference. Police needs loss evidence. Without transfer proof, report considered incomplete.

Delete actor chat. Many victims delete chat because upset. Deleting equals removing evidence. Just archive.

Negotiate with actor after reporting. Actor promises to return half. You withdraw report. Actor disappears again. Withdrawing makes it hard to re-report same case.

Report to fake Instagram accounts claiming cyber police. Many fake accounts claim to be cyber police and ask admin fee to help track. Police does not ask fee via DM. Check blue check and official .go.id or .id domain.

Spread actor data on social media with actor ID photo that may not be real. Spreading personal data can turn into ITE Law report against you. Focus on official channel.

Account recovery map after reporting

After reporting, focus on restoring accounts and finance.

Main email: Change password, enable app-based 2FA, logout all sessions.
Banking: Change PIN, enable transaction notification above $10.
Marketplace: Check if fake orders created by actor exist. Cancel and change password.
Social media: Enable 2FA, check login history, remove suspicious third-party apps.
Devices: Scan phone with antivirus, update OS, delete sideloaded APK unclear.

Account recovery without re-hardening makes account hacked again week later.

Victim rights under PDP and ITE Laws

Indonesia PDP Law 2022 gives rights to:

Get info whether your data processed.
Request access and copy of data.
Request deletion if not relevant.
Withdraw consent for processing.

If your data used without permission for loan, you can use this right to ask data controller to stop processing and delete.

ITE Law regulates illegal access, personal data spread, and extortion. Related articles often used for account hacking and sextortion cases. Investigators will determine relevant articles based on your evidence.

Legal consultation for cases with big loss above $6000 or cases involving company helps article formulation and compensation claim.

Case simulation: online shop account hacked and used to scam friends

You run online shop with 10k followers. Your shop account got phished via DM claiming Meta Support asks for blue tick verification. You clicked link, entered password, account taken over at 2 PM.

Actor changed recovery email, then DMed your friends asking money transfer saying need supplier down payment.

In real case, your friend transferred $200 because they trusted it was you.

After awareness, you did recovery and reporting.

You tried recovery via instagram.com/hacked with selfie video verification. Succeeded back within 4 hours because you had old selfie photo matching.
You changed email password same used for IG, enabled 2FA, logged out all sessions.
You made announcement in IG Story and feed: account had been taken over, do not transfer.
You collected phishing DM proof: phishing link, phishing email screenshot, IP log if any.
You reported to patrolisiber.id category account hacking, plus aduankonten.id to block phishing link.
You reported to friend bank for holding funds to new actor account.
You came to SPKT with complete evidence and friend LP number as derivative fraud victim.

Lesson: one phishing can become two crimes, hacking plus friend fraud. Fast recovery plus public announcement prevents additional victims.

How to create family SOP for reporting

Make one-page doc containing important numbers: family bank call centers, patrolisiber.id link, cekrekening.id, and steps to save evidence.

Save in family Google Drive accessible by spouse or adult child. When someone gets hit, everyone knows whom to contact first without panicked Google search.

Run 15-minute simulation every 6 months. Example: send dummy phishing link and ask family members to practice screen record and archive. Simulation makes real report faster.

24-hour checklist after cybercrime

Save evidence (screen record, screenshots, archive link, transfer proof)
Contact bank / e-wallet to hold funds, note ticket number
Change main email password and enable 2FA
Logout all sessions on other devices
Report patrolisiber.id for initial trail
Report cekrekening.id and aduankonten.id
Come to Polres Front Desk with neat evidence folder
Report to platforms for fake account takedown
Note all LP and ticket numbers in one place
Educate family / team not to fall for same mode

Print this checklist and keep in drawer near ID. When panicked, checklist more useful than searching links.

Sources and official contacts

Editorial note: This guide is educational and defensive. Procedure per Polres and bank may differ. Bring original ID when reporting. Do not pay parties claiming they can track actors with admin fee via personal transfer. If loss big, consider professional legal assistance.

Frequently asked questions

Is online report in patrolisiber.id enough?

Enough for initial trail, but for loss above $350 or business account hacking, coming offline to Front Desk gets processed faster and eases verification.

How long does fraud account blocking take?

Bank needs police report for formal blocking. Process 1-3 working days after complete LP. Report within first hour increases chance for temporary hold.

Must I pay to report to police?

No. Report at Front Desk is free. Beware accounts claiming to be police and asking admin fee.

How if actor uses foreign e-wallet account?

Still report to global e-wallet platform and include evidence. Blocking path harder, but report enters their global fraud system and prevents other victims.

Can report to Kominfo delete content within 24 hours?

Depends on platform and evidence. For clear cases like fake fraud plus LP, takedown can be 1-2 days. Gray cases need longer verification.

What difference between report to BSSN and Kominfo?

Kominfo for content and account blocking. BSSN for technical incident and infrastructure coordination. For individuals, start from bank, police, Kominfo.

How if police in my area not familiar with cyber case?

Bring neat evidence and show patrolisiber.id channel and ITE Law reference. Ask to be directed to Cyber Crime Investigation Unit at Polda. Polda usually has more specialized team.

Can I report if loss only $15?

Yes. No minimum loss to report. Small reports help cekrekening.id database so actor account gets flagged and prevents other victims with larger loss.

Does family SOP really help?

Yes. Family SOP reduces panic time. When everyone knows where to find bank call center and reporting links, hold funds attempt starts within minutes, not hours.