Beware of Digital Scams as THR Payouts Are Near: Two Common Tactics on the Rise
VIVA – As the period for releasing the Hari Raya Tunjangan (THR) for many workers approaches ahead of Lebaran, digital fraud targeting them is increasing. Data from VIDA’s findings throughout 2025 show a spike in digital fraud cases most commonly occurring ahead of and during THR disbursement. This moment is characterised by heightened transaction activity and mobility among people, which indirectly opens more gaps for perpetrators to carry out their schemes. VIDA founder and Group CEO Niki Luhur, in a statement received in Jakarta on Sunday, 8 March 2026, urged the public to be increasingly vigilant and to recognise the types of digital fraud that may occur so as not to fall into traps.
“Fraud always adapts. Every time defensive systems are strengthened, perpetrators test again, adjust techniques, and return with more complex and systematic methods. They exploit security gaps, weaknesses in digital literacy among the public, and certain moments to carry out their actions,” Niki said.
“Niki shared that there are at least two scam modalities to watch out for ahead of this THR moment.” Then:
“First is phishing or smishing. This method involves various ways to lure victims into clicking links and entering personal data such as usernames, passwords, and One-Time Passwords (OTP) via SMS. For example, perpetrators may impersonate a logistics agency or there may be an unknown number offering fake Ramadan promotions.”
“This modality also evolves through fake BTS methods, which last year were widespread and detected by the Government. This scam method allows fake messages to be sent en masse and appear to originate from official institutions, making them credible to recipients and something to beware of.”
“Next, the second scam is malware. This method entices victims to download dangerous applications in the form of APK files.”
“Don’t Click Randomly”
“The modus operandi used is varied, with the most frequent appearing as documents that seem important—such as package delivery status documents, wedding invitations, or other documents that appear relevant to the victim. If not vigilant, after download the application can install automatically on the device, enabling the attacker to monitor it remotely, including accessing passwords and various sensitive information stored or used on the device.”