MoSecureMany mobile fraud cases at Indonesian banks follow the same sequence: a phishing message arrives, the customer responds, the device is compromised, credentials are stolen, and a transaction is submitted. By the time that transaction reaches the fraud engine, the first four stages have already happened somewhere the bank can't see.
Not every case runs through all five. In many scams, such as fake online shops, nothing on the phone is compromised at all; the customer is simply persuaded to send the money. But where the device is part of the attack, the pattern repeats often enough to be worth mapping.
The five stages
- Phishing arrives. An SMS, a WhatsApp message, a social-media ad or a phone call. In March 2025, police described fake base stations in cars around Jakarta sending SMS made to look like they came from a bank.1
- The customer responds. They tap a link, enter details on a fake page, or install a file. The 2023 "wedding invitation" was an Android APK sent over WhatsApp that asked for SMS access once installed.2
- The device is compromised. Malware gains the permissions it needs. The Gigabud campaign documented in September 2026 asks for Accessibility access and the ability to draw over other apps.3
- Credentials are stolen. Through a phishing page, an intercepted OTP, or an overlay on top of the real banking app. Gigabud uses fake login screens and invisible overlays to capture credentials and the lock-screen code.3
- The transaction is submitted. From the attacker's device, or, as in the Gigabud campaign, from the victim's own phone under remote control, with valid credentials and a valid OTP.3
What each stage looks like from the bank
| Stage | Where it happens | What the bank can see |
|---|---|---|
| 1. Phishing arrives | Telecom network, messaging apps, social media | Nothing directly |
| 2. Customer responds | A fake website, a call, a file outside the Play Store | Nothing directly |
| 3. Device compromised | On the customer's phone | Only if something inside the banking app is watching: risky permissions, overlays, hooking, remote-access tools |
| 4. Credentials stolen | On the phone or on a fake page | Indirectly: a new device, a re-registration, an account recovery, an unusual login |
| 5. Transaction submitted | The bank's own systems | Everything the fraud engine normally checks |
The first two stages are outside the bank's reach. Stage five is where most fraud controls sit. Stages three and four are the gap: they happen on the customer's device or inside the banking session, where server-side rules have little to work with, and by stage five the transaction often looks legitimate.
Why waiting for stage five is expensive
Once money moves, recovery depends on how fast the victim reports. An OJK official said in August 2025 that on average 83% of victims only report after 12 hours, by which time the funds have usually been moved on.4 Every stage caught earlier is a transfer that never needs to be recovered.
Moving detection earlier
- Watch the device from inside the app. Risky Accessibility services, overlays on top of the banking app, hooking and tampering are visible to protection running inside the app, and they appear at stage three, before credentials are used.
- Treat stage-four events as risky actions in their own right. Device binding, re-registration and account recovery deserve the same scrutiny as a transfer, because they are how stolen credentials get turned into access.
- Judge the session at the moment of the transfer. A login that was clean ten minutes ago may now be remote-controlled. Re-check device and session context when money is about to move, not only at login.
- Feed it all to one decision. Device and session signals are most useful when they reach the fraud engine together with the transaction, as part of the same decision.
Where MoSecure fits. MoTogu runs inside the banking app and detects rooted devices, hooking, tampering and repackaging, which covers part of stage three. MoNetra checks the device and session for remote control, overlays, Accessibility abuse and malicious apps, also at stage three, and scores risk at login, device binding, credential changes and transfer, covering stages four and five. It returns ALLOW, STEP-UP or BLOCK to your fraud engine. Neither product sees stages one and two; that part still depends on customer education and on telecom and platform providers.
Related: Fake BTS: from SMS phishing to account takeover · Gigabud and the cloned banking app · The 12-hour window
Sources
- Antara, 24 Mar 2025: Bareskrim names two suspects in SMS phishing case using fake BTS
- Liputan6, 28 Jan 2023: Opening a WhatsApp wedding invitation can drain accounts
- Group-IB, 9 Sep 2026: Vwork, weaponized open-source software as an add-on for Gigabud
- Periskop, 14 Aug 2025: OJK, 83% of victims report after 12 hours
Figures are as reported by the sources above at the time of writing. Spotted an error? Email contact@mosecure.id and we will correct it.