Police establish five suspects in fake e-Ticket case impersonating Attorney General's Office
Jakarta — The Directorate of Cybercrime (Dittipidsiber) of the Police Headquarters (Bareskrim) has established five suspects in a fake e-Ticket case using SMS blast modus operandi that fraudulently invoked the name of the Attorney General’s Office (Kejagung) of the Republic of Indonesia.
“This SMS blast modus operandi involved deceptive phishing links using a fake e-Ticket scheme that impersonated a government institution, namely the Attorney General’s Office,” said Brigjen Pol. Himawan Bayu Aji, head of Dittipidsiber Bareskrim Polri, at the Bareskrim Polri building in Jakarta on Wednesday.
He revealed that the five suspects, with initials WTP (29), FN (41), RW (40), BAP (38), and RJ (29), were operating under the control of a Chinese national.
“The suspects in Indonesia served as extensions acting upon orders issued by the Chinese foreign national,” he stated.
The suspects held differentiated roles: WTP served as the primary operator conducting SMS blasting since September 2025; FN provided SMS blast services to foreign clients and managed SIM cards since July 2025; RW assisted in SMS blasting operations alongside FN since July 2025; BAP operated as the primary SMS blasting operator and device operator since February 2025; and RJ supplied and sold pre-registered SIM cards to other perpetrators.
Suspects WTP, FN, and RW operated under the control of Chinese nationals utilising Telegram accounts named Lee SK and Daisy Qiu. To support operations in Indonesia, the perpetrators from China directly dispatched SIM box devices—equipment used for SMS blasting—to the suspects in Indonesia, with systems remotely controlled or auto-remotely managed from China.
“In one day, the SIM box devices operated by the suspects were capable of sending phishing SMS messages to 3,000 mobile phone numbers,” he said.
In addition to the three mentioned suspects, the system was supported by suspect BAP, who served as a provider of activation services and creator of pre-activated and pre-registered Telegram accounts and WhatsApp numbers. In compensation for their work operating SIM boxes, the suspects received monthly salaries in cryptocurrency or USDT, ranging from 1,500 USDT (approximately IDR 25,000,000) to 4,000 USDT (approximately IDR 67,000,000), depending on the number of SIM boxes operated.
The five suspects’ actions were charged under Article 51 in conjunction with Article 35 of Law Number 1 of 2024 concerning the Second Amendment to Law Number 11 of 2008 on Information and Electronic Transactions and/or Article 45A paragraph (1) jo. Article 28 paragraph (1) of Law Number 1 of 2024 concerning the Second Amendment to Law Number 11 of 2008 on Information and Electronic Transactions and/or Articles 3, 4, 5, and 10 of Law Number 8 of 2010 on Money Laundering Offences and/or Article 607 paragraph (1) letters a, b, and c of Law Number 1 of 2023 on the Criminal Code in conjunction with Article 20 letter c of Law Number 1 of 2023 on the Criminal Code.