In March 2025, Bareskrim Polri announced the arrest of two suspects who had been driving around Jakarta with fake base stations (BTS) installed in their cars. According to police, the devices intercepted signals between real towers and nearby phones, pushed those phones from 4G down to 2G, and then broadcast SMS messages made to look like they came from a private bank, with links to fake sites.1 Komdigi said the equipment could operate across the 900 MHz, 1800 MHz and 2.1 GHz bands.2

Police said 259 customers of the impersonated bank reported incidents, with confirmed losses of Rp473 million from 12 victims, who had entered personal data including OTPs and card CVVs on the fake pages.1 In July 2026, police in Jakarta said they were again looking into reports of the same method.3

Why a fake BTS message is different

Ordinary phishing SMS travels through a mobile operator's network, where it can be filtered or blocked. A message from a fake base station is delivered directly to phones within range of the device, so it skips that layer entirely. Security commentators have also warned that the sender name can be made to match a bank's real sender ID.3 To the customer, it looks like another message from their bank.

The SMS is where it starts, not where it ends

Once a victim enters their details, the attacker has what they need for the next steps. The data collected can be used to:

  • activate internet banking, or recover access to it,
  • re-register the account on a different device,
  • steal credentials and OTPs,
  • push the victim to install a malicious APK, then automate actions on the phone,
  • take over the account outright, and
  • run further social engineering using what they now know about the victim.

For the customer, that can mean losing access to their account, unauthorised transactions and financial loss. For a bank or fintech, the impact doesn't stop at one transaction: more disputes, heavier investigation workload, reputational pressure, potential losses, and the need to respond to fraud faster.

What a bank can see, even though it can't see the fake BTS

The fake base station itself is a telecom problem; a bank has no view of it. What a bank can see is everything that happens afterwards, inside its own journeys. That is where the attack has to show itself:

  • A new device soon after a burst of phishing. Re-registration or internet-banking activation from a device the account has never used is the attacker's natural next step.
  • Account recovery that doesn't match the customer's history. Unusual time, unusual location, a device or network the account hasn't used before.
  • A session that behaves differently. Faster or scripted navigation, a new recipient straight after login, signs of remote control or automation.
  • Links between cases. The same device, network or receiving account showing up across several customers who reported the same SMS.

That is why fraud detection can't only look at the final transaction. Risk has to be read from the start of the journey: device, network, session, behaviour, signs of account takeover, and anomalies, before losses grow.

Where MoNetra fits. MoNetra doesn't detect fake base stations. It is built for the steps that follow: it scores device, session and reputation risk at login, device binding, password or PIN changes and transfer, and returns ALLOW, STEP-UP or BLOCK with reason codes, so banks and fintechs can spot takeover attempts earlier and decide quickly.

For customers

Don't open links in SMS messages, even ones that appear to come from your bank. Type your bank's address yourself or open its official app.3 If you have already entered your details, contact your bank straight away.

Sources

  1. Antara, 24 Mar 2025: Bareskrim names two suspects in SMS phishing case using fake BTS
  2. CNN Indonesia, 25 Mar 2025: Komdigi explains the fake BTS fraud method
  3. CNBC Indonesia, 29 Jul 2026: Fake BTS method resurfaces, police investigate

Figures are as reported by the sources above at the time of writing. Spotted an error? Email contact@mosecure.id and we will correct it.