E-Tilang Scam: Operators Paid in Crypto, Controlled by China
- Jakarta – Indonesian police have uncovered a sophisticated online fraud scheme involving fake e-ticket payment SMS blasts, with a surprising twist: the perpetrators were paid in cryptocurrency.
- Five individuals – WTP (29), FN (41), RW (40), BAP (38), and RJ (29) – have been arrested by the Directorate of Special Criminal Investigation (Dittipidsiber) of the...
- “The investigators conducted further investigation and examination of the five suspects and found the fact that this crime was directly controlled by foreign nationals from China,” said Brigadier...
Crypto Payments Fuel E-Ticket Scam in Indonesia
Jakarta – Indonesian police have uncovered a sophisticated online fraud scheme involving fake e-ticket payment SMS blasts, with a surprising twist: the perpetrators were paid in cryptocurrency.
Five individuals – WTP (29), FN (41), RW (40), BAP (38), and RJ (29) – have been arrested by the Directorate of Special Criminal Investigation (Dittipidsiber) of the National Police, according to authorities. Investigators determined the operation was directly controlled by Chinese nationals communicating via the Telegram accounts “Lee SK” and “Daisy Qiu.”
“The investigators conducted further investigation and examination of the five suspects and found the fact that this crime was directly controlled by foreign nationals from China,” said Brigadier General Himawan Bayu Aji, Director of Dittipidsiber, during a press conference in South Jakarta on Wednesday, February 25, 2026.
The Chinese controllers provided the Indonesian suspects with SIM boxes – devices used for sending mass SMS messages – to facilitate the fraudulent scheme. The Indonesian suspects’ roles were varied.
WTP (29) operated the devices and conducted the SMS blasting, beginning in September 2025. FN (41) provided SMS blast services to foreign clients and managed the SIM cards, starting in July 2025. RW (40) assisted FN with the SMS blasting operations, also beginning in July 2025. BAP (38) was a primary operator of the SMS blasts and the blasting devices, starting in February 2025. RJ (29) supplied registered SIM cards to the other perpetrators.
Authorities say the Chinese nationals directed the Indonesian accomplices to install SIM cards into the SIM boxes, which were then remotely controlled from China. The Indonesian suspects accessed a system called Terminal Vendor System (TVS) to monitor the number of SMS messages sent and those that failed to deliver.
“In one day, the SIM box devices operated by the suspects were able to send phishing SMS messages to 3,000 mobile phone numbers,” Himawan explained. “To operate these SIM boxes sent from China, the perpetrators needed hundreds of SIM cards registered using the identification numbers and data of Indonesian citizens.”
How the Scam Worked
The scam unfolded when victims received unsolicited SMS messages from unknown numbers, falsely claiming outstanding traffic violation fines and including a link. Clicking the link directed victims to a fraudulent e-ticket website that closely resembled the official website of the Public Prosecutor’s Office.
Believing the website to be legitimate, victims entered their personal and credit card information, resulting in unauthorized debit transactions totaling 2,000 Saudi Riyals (approximately Rp 8.8 million) per victim.
Police investigations subsequently identified 124 additional phishing websites and six additional phone numbers used to distribute the SMS blasts.
Paid in Cryptocurrency
The Indonesian suspects were compensated for their involvement with monthly payments in the form of cryptocurrency, specifically USDT. Payments ranged from 1,500 USDT (approximately Rp 25 million) to 4,000 USDT (approximately Rp 67 million), depending on the number of SIM boxes operated.
“The suspects received monthly payments in the form of cryptocurrency or USDT, ranging from 1,500 USDT or around Rp 25 million to 4,000 USDT or around Rp 67 million depending on the number of SIM boxes operated,” Himawan stated.
BAP (38) reportedly received the largest payout, totaling 53,000 USDT (approximately Rp 890 million) across 142 transactions between February 2025 and January 2026. RW received 42,300 USDT (approximately Rp 700 million) between June 2025 and January 2026. FN received 14,100 USDT (approximately Rp 235 million) between July 2025 and January 2026. WTP received 32,700 USDT (approximately Rp 530 million) across 43 transactions between September 2025 and January 2026.
Investigators found that the suspects routinely exchanged their cryptocurrency earnings for Indonesian Rupiah on a monthly basis.
The five suspects face charges under Articles 51 in conjunction with Article 35 of Law Number 1 of 2024 concerning Amendments to Law Number 11 of 2008 concerning Information and Electronic Transactions, and/or Article 45A paragraph (1) in conjunction with Article 28 paragraph (1) of Law Number 1 of 2024 concerning Amendments to Law Number 11 of 2008 concerning Information and Electronic Transactions, and/or Articles 3, 4, 5, and 10 of Law Number 8 of 2010 concerning Money Laundering Prevention, and/or Articles 607 paragraph (1) letters a, b, and c of Law Number 1 of 2023 concerning the Criminal Code in conjunction with Article 20 letter c of Law Number 1 of 2023 concerning the Criminal Code. The penalties include a maximum prison sentence of 15 years and a maximum fine of Rp 12 billion.