At Indonesia’s biggest bank, customers’ savings can vanish with a click

Bali and Jakarta, Indonesia – Late last year, Balinese woman Nih Lu Putu Rustini got the shock of her life when she tried to withdraw cash from an ATM to complete a renovation project at her ancestral home.

Working as a cleaner during the day and a nanny by night, Rustini had saved 37 million Indonesian rupiahs ($2,340) in an account at Bank Rakyat Indonesia, Indonesia’s largest bank.

But the ATM showed a balance of almost zero.

When she visited her local BRI branch, a teller informed her that her money was gone.

“They said a hacker had stolen my money and they could not return it to me,” Rustini told Al Jazeera.

“It’s not fair because it took me a long time to earn that money but the hackers took it in seconds. I was shocked.”

I Made Rai Dwi Ada Diatmika, a leather goods manufacturer in Bali, had a similar experience last August when he tried to make his first withdrawal in years.

A hacker had cleared out his savings of 72 million rupiahs ($4,650) the previous May.

As in Rustini’s case, BRI refused to accept responsibility for the loss.

“When I opened the account at BRI three years ago, they asked me to download their app onto my phone. They said it was safer because I would get daily reports. But I never used it as I forgot the password,” Diatmika told Al Jazeera.

“We put our money in the bank for security. But if hackers can get in so easily and find all our data, BRI must have a big problem with their security.”

Rustini and Diatmika are among numerous BRI customers whose savings were stolen by hackers via the bank’s mobile app.

As Southeast Asia’s largest economy, with the fourth-highest number of internet users and the fifth-largest e-commerce sector in the world, Indonesia is an attractive target for cybercriminals.

Data published by Indonesia’s National Cyber and Encryption Agency shows there were 361 million online traffic anomalies between January 1 and October 26 in the country last year.

Attacks on email accounts in Indonesia rose by 85 percent in the third quarter of 2023, even as breaches in countries such as the US and Russia declined, according to data collected by Netherlands-based cybersecurity firm Surfshark.

Meanwhile, Indonesia ranks third from last among G20 countries for preventing and managing cyber threats, according to Estonia’s National Cyber Security Index.

“There’s a lot of information out there indicating Indonesia is one the world’s largest sources and targets for cybercrime,” Gatra Priyandita, an analyst with the Australian Strategic Policy Institute’s Cyber Policy Centre in Sydney, told Al Jazeera.

“Indonesians are more vulnerable in a way because of their poor digital hygiene. They are becoming more aware of the problem but when you have 200 million people suddenly jumping online, they will always be more vulnerable.”

Government websites are the number one target of cyberhackers in Indonesia, followed by the energy and financial sectors, according to the Mandiant M-Trends 2023 survey.

“Banks are targets because banks are where the money is,” BRI’s head of information Muharto, who like many Indonesians goes by only one name, said at a forum in Jakarta in June.

“Cybercriminals are now collaborating with each other and operating as a group with combined capabilities,” he said, adding: “Banks cannot fight cybercrime alone and must synergise [their efforts] with the government and regulators.”

BRI does not publicly share data on how many of its customers’ accounts have been hacked.

The bank did not responded to inquires before publication.

But in a statement provided to Al Jazeera after this article was published, BRI said it follows internationally recognised cybersecurity standards, including the US-based National Institute of Standards and Technology’s Cybersecurity Framework, and it established a cybersecurity team led by an experienced Chief Information Security Officer (CISO).

The bank said it utilises a “comprehensive approach” to minimise the risk of customer data breaches, including using artificial intelligence (AI) to detect fraudulent patterns and threats.

“Our commitment to data security is evident in our internal policies and the establishment of the CISO. We consistently upgrade network security and utilise advanced technologies like Data Loss Prevention (DLP) to strengthen our defenses,” said Arga M. Nugraha, BRI’s Director of Digital & Information Technology.

The bank said it works closely with law enforcement and other authorities to combat cybercrimes.

“Cybercrimes demand a unified response from the financial sector,” Arga said.

BRI said it also provides extensive education about cybersecurity risks to customers through its social media channels and the media.

Despite BRI’s “proactive measures”, the bank said, customers should remain vigilant about protecting their personal and banking information, and refrain from disclosing sensitive information to unauthorised individuals.

In February of last year, BRI permanently closed the website version of its e-banking services and diverted all online transactions to its new mobile banking app BRImo, claiming it was “safer” and “easier for customers to access”.

Ardi Sutedja Kartawidjaya, chairperson of the Indonesian Cyber Security Forum in Jakarta, said that in “90 percent of cyberattacks against bank accounts, the fault lies within the customer because of their negligence and fraud schemes that are becoming more and more sophisticated”.

But if it can be proven that the victim did not enable the breach, the missing funds can be replaced under the Indonesian government’s deposit guarantee scheme.

“First the victim must file a police report, who are required to investigate according to the Personal Data Protection Law of 2022. But bear in mind that this process takes quite some time as it requires complex forensic digital investigative skills,” Kartawidjaya told Al Jazeera.

ASPI’s Priyandita said that Indonesian authorities’ capacity to investigate such crimes is limited due to a limited number of digital forensics specialists.

“The National Cyber and Encryption Agency had its budget cut from 2 trillion [rupiahs] in 2019 to 100 billion [rupiahs] during the pandemic – a time when arguably more funding was needed. The budget is now 600 billion [rupiahs], but it still isn’t enough,” he said.

In Bali, cybercrime victim Diatmika has experienced the problem of under-resourcing firsthand.

“I provided the police with all the details, including the name and account number of the person in Java who stole my money. But they said they didn’t have any budget to travel to Java and investigate, and that if I wanted a refund, I had to fight the bank. But to do that I needed a lawyer. I have no more money, so I was forced to give up,” he said.

Like Diatmika, Rustini, who insists she did not download any suspicious apps or clink on suspect links, initially did not intend on fighting BRI, considering the cost of hiring a lawyer to be out of reach.

But after Balinese law firm Malekat Hukum offered to represent her pro-bono, she filed a complaint with the police.

In addition to filing a suit against BRI, Malekat Hukum has lodged a case with Indonesia’s Alternative Dispute Resolution Institution in the hope of settling the matter through mediation.

BRI has so far failed to respond to requests for mediation.

Ni Luh Arie Ratna Sukasari, a partner with Malekat Hukum, said Rustini’s losses are the tip of the iceberg at BRI.

“BRI Bank is notorious for cyberattacks. I have heard of many passing cases where their customers lost everything, and we need to do something about it,” she told Al Jazeera.

“They’re supposed to be serving their customers and protecting their customers’ money. Their argument that they are not responsible just doesn’t stand. They’re the ones who need better security, not their customers. And if they cannot offer secure online banking, they shouldn’t be offering it – period.”

Diatmika said he knows other BRI customers who have been similarly scammed.

“There was a man who lived only three minutes from my house. He had a stroke and died after 1 billion rupiahs [$64,500] was stolen from his account. His family had to sell their house,” he said.

Cybersecurity expert Kartawidjaya said the phenomenon is not unique to BRI.

“Almost all financial service providers in Indonesia are experiencing constant cyberattacks. But most don’t report such events for reputation management reasons,” he said.

Priyandita said he fears that cybersecurity in the country will get worse before it improves.

“Indonesia is banking on digital technology as a key driver of growth, but cyber security is simply not the priority it should be,” he said.

“Efforts are being made to respond to the problem, but again these are limited by resourcing.”