Credit Card Fraudsters Using Fake BTS to Spread Phishing SMS Uncovered
The Cyber Crime Directorate (Ditressiber) of the Jakarta Metropolitan Police has named five suspects in a credit card breach case. The modus operandi of the five suspects involved sending SMS blasts containing links to fraudulent websites using fake BTS technology.
“The suspects’ method of spreading these phishing links was by using blasting tools or fake BTS equipment,” explained AKBP Grawlar Sugiharto, Head of Sub-directorate IV of the Jakarta Metropolitan Police Cyber Crime Directorate, during a press conference at the Jakarta Metropolitan Police Public Relations building, South Jakarta, on Friday (2/10/2026).
“This fake BTS is a device that simulates the GSM frequency spectrum to mobile phones in the vicinity of the device, allowing it to operate like an authentic BTS, even though it is a shadow or fake BTS,” he continued.
Grawas explained that the investigation into this case began following reports from three victims who received SMS messages containing promotions impersonating banks and e-commerce platforms. In these messages, victims were provided with a link to a fraudulent website designed to mimic the legitimate websites of banks and e-commerce companies.
“Each victim received different messages. Some were from banks, some from e-commerce, and some from service providers. The core message stated, ‘Your points balance is about to expire. To redeem them for vouchers or goods, please click the following link,’ directing them to a fake website that resembled the original,” Grawas revealed.
“Once they entered the fake website, the victims were prompted to enter their credit card details,” he added.
He stated that the police immediately conducted a series of investigations. Ultimately, on 31 July 2026, a vehicle suspected of being linked to the fraudulent SMS activities was identified.
“The team conducted an investigation and found a silver car with plate number B-2755-XXX, which was suspected of driving slowly and frequently travelling back and forth along the routes previously mentioned,” explained Grawas.
“Based on this, the team conducted a search and subsequently discovered a fake BTS device being operated by Mr GM, who served as the driver.”
Grawas stated that upon being apprehended, GM admitted to working under the orders of an individual with the initials NL. Investigators are now further examining the role of NL, who was responsible for sourcing the vehicle and the driver.
“Following information from Mr NL, we expanded our investigation and subsequently arrested Mr AGW. It was AGW who was responsible for paying both Mr NL and Mr GM,” he said.
From AGW, investigators identified two other suspects: JYI, the technician responsible for installing the fake BTS equipment into the vehicle, and AD, who managed the content and volume of the SMS blasts sent by GM.
Grawas explained that the police seized several pieces of evidence, including one vehicle and a fake BTS kit consisting of a battery, amplifier, power supply, and the fake BTS device itself. Also seized were five mobile phones, as well as bank passbooks and ATMs used for the operations of the fake BTS scheme.
“We are continuing to develop this case and will further investigate the connections and roles of other potential suspects,” he concluded.