How do I check whether a crypto platform is legitimate or a scam?

Open OJK's whitelist of digital financial asset traders and match the company name and the exact website or app address. The same brand on another domain is not licensed. If it is not on the list, assume no OJK protection, and if you are still unsure call OJK's contact centre on 157.

Where do I report a crypto scam in Indonesia?

Call OJK on 157, which is the channel for OJK and Satgas PASTI, file a police report with full evidence, and tell the bank or e-wallet you paid from immediately. We could not confirm contact details for the Indonesia Anti-Scam Centre, so ask about it through 157.

What are the warning signs of a crypto scam?

Guaranteed returns or multiplied bonuses, a disguise as an education community, a stranger messaging you first, pressure to deposit quickly, and web addresses that only resemble a real brand. Licensed platforms are not allowed to promise guaranteed profit. If the promise is not believable, stop.

What is Satgas PASTI?

An OJK-led task force against illegal financial activity, working with Komdigi, the police and other bodies. It halted 953 illegal entities in January-March 2026 and 228 illegal digital financial asset traders in January-May 2026, according to Bareksa and CNBC Indonesia.

Can I get my money back after a crypto scam?

There is no guarantee. The faster you report, the better the chance funds are blocked. According to Bareksa the Indonesia Anti-Scam Centre returned Rp169 billion and Satgas PASTI blocked about Rp585.4 billion of victims' funds in January-March 2026, but those figures cover all financial scams, not crypto alone.

Is it safe to swap USDT for cash in Bali?

There are real risks. Robberies and kidnappings aimed at crypto holders have been reported in Bali since December 2024, including a July 2025 attempt on a money changer delivering cash to a villa. The operators we found are self-described claims. Do not accept cash delivery at private locations.

Are foreign crypto platforms automatically scams?

No. Large foreign platforms are not scams, but they are unlicensed by OJK, so there is no consumer protection and OJK may be unable to help. Scam means intent to defraud, while unlicensed is a legal status. Our legal page explains the difference.

Crypto scams in Indonesia: verify, red flags, what to do

The answer you can use in five minutes: before you send rupiah to any crypto platform, confirm that the company name and the exact web or app address are on OJK's whitelist, and test whether the promised profit is believable. OJK calls those two tests the "2L" principle: Legal and Logical. If either fails, stop. If you are unsure, call OJK on 157. This page has the detailed checks, the red flags, the Bali incidents that the press has reported (with dates), and the practical steps if you have already been caught. If you want the legal status instead, see is crypto legal in Indonesia.

Checked against sources

Check in five steps before you send money

Open OJK's official list on the Licensing of ITSK, digital financial assets and crypto assets page. It is published as dated PDFs, so take the newest.
Match the exact company name (PT), not just the brand. Anyone can use a brand, while a licence belongs to a company.
Match the web address and app name. The list covers each entity's official sites and channels. A look-alike domain (one letter off, a different ending) means it is not the licensed entity.
Read the status. PAKD is licensed, CPAKD is still a candidate and not fully licensed. The difference is explained on the legal page.
Still unsure, call 157 (Kontak OJK). Do not ask the "admin" who contacted you first. {{/steps}}

One extra habit we recommend: never open a platform from a link in a message or an ad. Type the address yourself, or download the app from the link on the company's official page. Pluang Academy describes a similar routine in its article on checking OJK-registered crypto apps. If you are just starting, our how to buy crypto guide walks through the path from day one using apps that pass this check.

How big is the problem?

We have no crypto-specific victim count to rely on. What exists is the wider picture from Satgas PASTI, the OJK-led task force that works with Komdigi, the police and other agencies.

953illegal entities halted by Satgas PASTI, Jan-Mar 2026

228illegal digital financial asset traders halted, Jan-May 2026

Rp585.4bnvictims' funds blocked, Jan-Mar 2026

Of the 953 entities halted in January-March 2026, 951 were illegal loan apps and 2 were illegal investment offers (Bareksa, 29 April 2026). That figure is not crypto-specific. For crypto, Satgas PASTI halted 228 illegal digital financial asset traders in January-May 2026 (CNBC Indonesia, 22 June 2026). According to Bareksa, the Indonesia Anti-Scam Centre (IASC) returned about Rp169 billion to victims. The blocked and returned money covers all kinds of financial scams, so do not read it as your odds of recovery in a crypto case.

PPATK adds another piece of context. In January-June 2026 PPATK halted transactions on 5,762 online-gambling accounts worth Rp1.07 trillion, and according to its statements crime proceeds are laundered through crypto, including about Rp800 billion in 2023-2024 (as reported). That is one reason bank accounts linked to unusual transactions can be frozen, and it affects ordinary buyers and sellers on P2P.

The clearest red flags

Below are patterns cited in press coverage and OJK warnings, combined with our own general reasoning. We mark the parts that are general patterns, not official data.

Guaranteed returns or multiplied bonuses. Fixed profit and multiplied bonuses are typical pitches named in press coverage of crypto fraud. OJK's rules (Article 124 of POJK 27/2024, via a secondary summary) also require transparent information and risk warnings and ban claims of guaranteed profit. Crypto prices move up and down. Whoever guarantees profit is lying or unlicensed.

The "education community" disguise. A chat group teaches you to trade, then steers you to one specific platform for "practice". This is also a pattern named in press coverage.

Someone contacts you first. A stranger on a messaging app or social media offers an investment opportunity. This is a general pattern, not OJK data, and you should treat it as suspicious right away.

A domain that resembles the brand. Same app name, different address. That is why you match the domain, not only the name.

Time pressure and ransom fees. A general pattern of investment fraud, not OJK data: you are asked to deposit more for a "fee", "tax" or "verification" before you can withdraw. Real tax is withheld from your sale proceeds, not paid up front to a third party (see crypto tax).

"Fund recovery" services. After a loss, someone offers to get your money back for an upfront fee. Also a general pattern: never pay anyone who promises results.

Scams on P2P and OTC routes

On P2P, buyers and sellers deal person to person on foreign platforms. We have no incident data, only categories of risk. First, third-party payment: the sender's name does not match the account. Some sellers on Bybit P2P add a warning to their ads that the sender's name must match the registered account (we saw this live. Second, reversal after the coins are released, especially through payment methods that can be recalled. Third, fake "customer support" that contacts you outside the platform and asks you to release the coins.

The practical rules: release coins only after the money has actually landed in your account, never leave the platform's official chat, and do not accept payment from anyone else. The full discussion is in the P2P guide. For large amounts through OTC desks, read the OTC guide and verify the operator's licence first.

Incidents in Bali that the press has reported

The most dangerous thing in Bali is not an on-screen scam but physical violence aimed at crypto holders and cash couriers. Below are three cases reported in the press, in date order. We draw no conclusion about guilt, because all are in legal process or are media reports.

Date of incident	What was reported	Source
15 Dec 2024, South Kuta	Ukrainian businessman Ihor Yermakov was intercepted, beaten and forced to unlock his Binance account. About USD 214,429 (around Rp3.5 billion) was taken. The perpetrators are described as a group of Russian nationals.	Euromaidan Press, 31 Jan 2025
27 Jul 2025, Tuban, Kuta	A "client" contacted a money changer on Telegram to swap 9,700 USDT (about Rp153 million, later raised to Rp191 million) and asked for cash to be delivered to a villa. Two foreigners attacked two employees, one claiming to be an Interpol agent. Residents stopped it. Charged under Article 365(2) of the Criminal Code.	Antara, 28 Jul 2025
2 Jul 2026, South Kuta (Pecatu)	A Russian national was held for about 30 hours and beaten to force him to hand over crypto-account passwords. Police presented the case on 9 July 2026. Losses are unverified and the investigation continues.	Antara, 9 Jul 2026

The pattern we can see, without blaming victims: the targets held crypto or large amounts of cash, two victims were forced to unlock accounts or hand over passwords, and one case began with an order for cash delivery to a villa. So do not receive or hand over cash from a crypto swap at a private location or villa, and do not indulge a "client" who wants to meet at a place of their choosing. If you must swap, do it at a licensed money changer's premises.

Bank Indonesia counted 601 licensed non-bank money changers (KUPVA BB) in Bali in 2025, and provides moneychangerbali.com and BI-PATROL for reporting. Licensed changers display a BI certificate, their registered name and a QR-coded logo (Antara Bali, 13 March 2026). We do not know whether the money changer in the Tuban case was licensed, and we found no news of police or immigration arresting a tourist merely for swapping USDT for cash. The USDT operators we found in Bali are self-described claims and are unverified. More context is in the cash guide and crypto in Bali.

Account security: the part you control

Not every loss comes from a fake platform. Many happen because a real account is hacked or its owner is talked into handing over access. This is general advice, not a finding from our research, but it is cheap and effective.

Turn on two-step authentication on your crypto app, email and the phone number attached to them, and prefer an authenticator app to SMS alone. Use a unique password per platform. Never send a photo of your ID card, your verification selfie or a screenshot of your balance to someone you do not know, because that is raw material for opening accounts in your name. If you use a personal wallet, the recovery phrase must never be photographed, stored in the cloud or typed into any website. The difference between a platform wallet and your own is covered in the crypto wallet guide.

One more thing the Bali cases show: if someone forces you to unlock a crypto account, what they can take is about the size of the balance sitting there. So keep only what you need in the account you use day to day.

If you have already been scammed

Speed matters. Work through this in order.

Stop paying. Do not deposit any extra "fee". Do not contact anyone who promises paid recovery.
Keep the evidence: chat screenshots, website address, destination bank account number, wallet address, transaction IDs and proof of transfer.
Contact your bank or e-wallet immediately to report the transfer and ask that the destination account be acted on. We have no data on how often this works, but sooner is better.
Report to OJK on 157, which is the channel for Satgas PASTI. We could not confirm the official contact details for IASC, so ask through 157.
File a police report with all the evidence. If violence or kidnapping is involved, call the emergency numbers 110 (police) or 112.
Secure what is left: change passwords, turn on two-step authentication and move coins to a safe account or wallet. See the best crypto wallets. {{/steps}}

Do not hand it to a middleman

On the chance of recovery: there is no guarantee, and we found no crypto-specific recovery figures. Do not borrow to cover a loss.

Unlicensed is not always a scam, but it is unprotected

It matters to separate two things. A scam is intent to defraud, such as a cloned platform that runs off with deposits. Unlicensed by OJK is a status: a large foreign platform that is not on the whitelist is not automatically a scam, but you sit outside OJK supervision with no official complaints channel, and OJK states that entities outside the list are not licensed or supervised. For example, CEX.IO holds registrations in the UK and the US according to its own legal pages, but it has no OJK licence and does not support rupiah. The full facts are in the CEX.IO review. The status of foreign platforms is explained on the legal page, and the licensed apps we compare are in the best crypto exchanges.

Finally, two simple habits that close most gaps: never share a one-time code, password or wallet recovery phrase with anyone, including someone claiming to be platform staff, and never lend your bank account or your KYC to anyone. And remember the 2L rule: Legal and Logical.

How to spot crypto scams in Indonesia, and what to do if you have been scammed

Sources & verification

Frequently asked questions

Keep reading