TL;DR: Fake BTS devices mimic legitimate cell towers to send fraudulent SMS messages, often to steal one-time passwords (OTPs). But a stolen OTP should not automatically be enough to access a victim’s account. It is time to stop placing the entire burden of fraud prevention on consumers.
Fake BTS devices impersonate legitimate Base Transceiver Stations (BTS), or cellular towers, allowing them to interact with nearby mobile devices and send bulk SMS messages that appear to come from official sources. In a case recently uncovered by police near Jalan Sudirman in Jakarta, these devices could send up to 20,000 phishing SMS messages a day, impersonating official bank communications.
Victims who click the links in these messages are directed to fake websites and prompted to enter their PINs, OTPs, or credit card numbers. Fraudsters can then use this information to take over their accounts.
Is It an Infrastructure Failure or the Victim’s Fault?
Fake BTS scams raise a question that is rarely discussed openly: when fraudulent messages look this convincing, should consumers bear the blame for falling victim to them?
VIDA Founder and Group CEO, Niki Luhur, raised this question during a podcast conversation with independent journalist Andini Effendi.
“We’ve spent years educating the public not to share their OTPs. But if so many people are still falling victim to scams like these, we need to ask ourselves: is it really the consumer’s fault?” Niki said.
For Niki, the answer points to the responsibility of financial institutions. They need to strengthen their security systems so that stolen OTPs and credentials do not automatically give fraudsters access to victims’ accounts.
Why Two-Factor Authentication Is Not Always Enough
Niki added that financial institutions must ensure that stolen OTPs or credentials alone are not enough to take over an account. Two-factor authentication (2FA), for example, does not automatically guarantee strong security.
Its effectiveness depends on the authentication factors used and whether they can establish that access is being requested by the rightful user, rather than simply someone who has entered the correct code.
Three Layers of Verification
To address this challenge, security systems need to verify more than just the codes or credentials entered by users. Niki outlined three layers of verification that can strengthen this approach: Verified Person, to confirm that the person accessing a service is the legitimate user; Verified Document, to check the authenticity of identity documents used during verification; and Verified Device, to assess whether access is coming from a trusted device.
Together, these three layers strengthen identity checks at different stages of the user journey. In account takeover scenarios, verifying both the user's identity and their device can provide additional protection, ensuring that a stolen OTP is not the sole basis for granting access to a bank account.
Niki also believes security standards should account for the risk associated with an activity, not just the value of a transaction. A password reset, for example, does not directly involve transferring money, but it can create an opening for account takeover and unauthorized transactions.
“When determining whether an activity is high-risk, we cannot look only at the amount of money involved. A password reset, for example, has no transaction value, but it can be a gateway to taking over an account. We need to consider the risks and potential for abuse associated with the activity,” Niki explained.
Authentication requirements should therefore be proportionate to the potential for misuse and the impact of each activity, rather than determined solely by the size of a transaction.
For VIDA, fake BTS scams underscore the importance of strengthening digital identity infrastructure as more financial activities move online. Public education remains essential, but it must go hand in hand with security systems designed to verify users' identities, assess device trustworthiness, and respond to risks appropriately.
Watch the full podcast conversation between Andini Effendi and Niki Luhur on fake BTS scams, consumer protection, and digital security here.
.png)
