Jakarta, October 20, 2026 – In early October 2026, police uncovered an operation involving fake Base Transceiver Station (BTS) devices near Jalan Sudirman, Jakarta. The devices were capable of sending up to 20,000 fraudulent SMS messages, or phishing messages, per day. By impersonating legitimate cellular towers, they could send scam messages designed to look like official communications from banks.
In response to this emerging threat, VIDA Founder and Group CEO Niki Luhur, speaking on a podcast with independent journalist Andini Effendi, emphasized that consumer protection cannot rely solely on public awareness. In fake BTS scams, victims can be manipulated by SMS messages impersonating banks into entering their PINs, OTPs, or credit card numbers on fraudulent websites. Fraudsters can then use this information to take over their accounts.
According to Niki, these incidents raise an important question about consumer responsibility as scam messages become increasingly convincing. “We’ve spent years educating the public not to share their OTPs. But if so many people are still falling victim to scams like these, we need to ask ourselves: is it really the consumer’s fault?” Niki said during the podcast.
Niki stressed that financial institutions must also ensure that stolen OTPs or credentials alone are not enough to take over an account. Two-factor authentication (2FA), for example, does not automatically guarantee strong security. Its effectiveness depends on the authentication factors used and their ability to establish that access is being requested by a legitimate user.
To address this challenge, security systems need to verify more than just the codes or credentials entered by users. This approach can be strengthened through three layers of verification: Verified Person, to confirm that the person accessing a service is the legitimate user; Verified Document, to verify the authenticity of identity documents used during the verification process; and Verified Device, to ensure that access comes from a registered and trusted device. In account takeover prevention, these additional layers help ensure that a stolen OTP alone is not enough to gain access to a bank account.
Niki also believes that security standards should account for the risks associated with an activity, rather than focusing solely on transaction value.
“When determining whether an activity is high-risk, we cannot look only at the amount of money involved. A password reset, for example, has no transaction value, but it can be a gateway to taking over an account. We need to consider the risks and potential for abuse associated with the activity,” Niki explained.
In line with this approach, VIDA offers ID FraudShield, an identity fraud detection solution built around multiple layers of defense. Integrated with biometric verification, the technology analyzes device intelligence, user behavior, network signals, and location data in real time to detect potential fraud that biometric checks alone may miss. By assessing multiple risk indicators, ID FraudShield helps service providers identify potential fraud earlier.
Strengthening digital identity infrastructure is becoming increasingly important as fraud tactics continue to evolve. Public education remains essential, but it must go hand in hand with proactive and preventive security systems. Consumer protection must be an integral part of innovation, not an afterthought.
Watch the full discussion on fraud tactics, consumer protection, and digital security in the podcast featuring Andini Effendi and Niki Luhur here.
Visit vida.id to learn more about VIDA and Where’s the Fraud, VIDA’s educational hub for identifying and preventing digital fraud.