The 12-hour window: why most scam money is gone before the victim calls the bank

Since the Indonesia Anti-Scam Centre (IASC) opened in November 2024, Indonesians have filed more than 579,000 scam reports with it. By the end of May 2026 it had blocked Rp638.9 billion in funds and returned Rp169.3 billion to victims.⁴ Those are real results. They look different next to the losses.

Through November 2025, victims had reported Rp8.2 trillion in losses, against Rp389.2 billion blocked in the same period.³ That is under 5 cents of every rupiah reported. An earlier snapshot, to mid-August 2025, shows the same shape: Rp4.6 trillion reported, Rp349.3 billion blocked.¹

The money moves faster than the report

OJK has been direct about why. The first 12 hours after a transfer decide whether funds can still be secured, because stolen money is split and passed through other accounts quickly.¹ In August 2025, an OJK official said that on average 83% of victims only report after those 12 hours have passed. "By then the money has gone everywhere" (our translation).²

Volume makes it harder. IASC receives around 700 to 800 reports a day, compared with roughly 140 in Singapore and 130 in Malaysia.¹ And the account side is enormous: 998,558 accounts had been reported by May 2026, of which 515,554 were blocked.⁴

What the top scam types have in common

The five most reported methods to May 2026 were online shopping fraud (77,740 reports), impersonation and fake calls (47,269), investment scams (26,649), job scams (23,910) and social-media fraud (20,469).⁴

In most of these, nobody breaks into the bank. The customer logs in on their own phone, with their own PIN, and sends the money themselves, because someone has convinced them to or is steering the session for them. From the bank's server, that transfer can look perfectly normal: right credentials, right device, a valid OTP.

That is why recovery after the fact will stay a small fraction. A faster reporting channel helps at the margin. The larger opportunity is earlier: at the moment the transfer is being made.

What banks can do before the report

• Score the action, not just the login. A session that was trusted at login can change: a remote-access app starts, a new recipient appears, the pace of taps changes. Risk should be re-evaluated when money is about to move.
• Make friction selective. Stepping every transfer up trains customers to approve prompts without reading them. Step up when the device or session context is unusual, and let clean sessions through.
• Measure your own window. Track the time from a fraudulent transfer to the customer's report, and from report to block. If most of your cases sit past 12 hours, recovery will not be your main defence.
• Treat receiving accounts as signal. Nearly a million reported accounts is a pattern, not noise. Device reuse and linked-account behaviour on the receiving side help catch mules before the next victim.