Polri Reveals Role of Chinese Nationals in Fake e-Ticket SMS Scam

Jakarta (ANTARA) - The Cybercrime Directorate (Dittipidsiber) of the Indonesian National Police (Polri) has revealed the role of Chinese nationals in the case of fake e-ticket SMS messages that impersonated the Attorney General’s Office (Kejagung).

The Director of Cybercrime (Dirtipidsiber) of the Polri’s Criminal Investigation Unit (Bareskrim), Police Brigadier General Himawan Bayu Aji, at the Polri’s Criminal Investigation Unit building in Jakarta on Wednesday, said that they had named five suspects in this case, namely WTP (29), FN (41), RW (40), BAP (38), and RJ (29).

“The suspects in Indonesia acted as intermediaries who received and carried out orders from Chinese nationals,” he said at the Polri’s Criminal Investigation Unit building in Jakarta on Wednesday.

He revealed that, based on the investigation, suspects WTP, FN, and RW were operating under the control of Chinese nationals who used Telegram accounts named Lee SK and Daisy Qiu.

To support their operations in Indonesia, the perpetrators from China sent SIM boxes, devices used for SMS blasting, directly to the suspects in Indonesia.

“From the seven SIM box units, two shipments were identified in September and December 2025, and the rest are still being investigated,” he said.

Based on the shipping evidence, the SIM box devices were sent by someone named Wuga from Shenzhen City, Guangdong, China. The first shipment was in September 2025, and the second was in December 2025.

However, the SIM box devices were not sent for free. The Chinese nationals initially paid for the procurement costs, and the payment was made by deducting the commission received by the suspects.

“If we estimate the price of a SIM box, it is around Rp4 million for one SIM box,” he said.

Himawan continued, for the operational system, the Chinese nationals controlled the suspects in Indonesia to install SIM cards into the SIM boxes. Then, the system was controlled remotely from China.

The suspects in Indonesia only needed to open an application called Terminal Vendor System (TVS). Through this application, the suspects could monitor the number of successful and failed SMS blasts.

“In one day, the SIM box devices operated by the suspects were able to send phishing SMS messages to 3,000 mobile phone numbers,” he said.

In addition to the three suspects, this remote working system was also supported by suspect BAP, who acted as a provider of activation services and created Telegram and WhatsApp accounts that had been activated and registered.

He said that BAP had known a Chinese national named Chen Jiejie since 2023 and started working in February 2025.

As a reward for their work, the suspects received monthly salaries in the form of cryptocurrency or USDT, ranging from 1,500 USDT or around Rp25,000,000.00 to 4,000 USDT or around Rp67,000,000.00, depending on the number of SIM boxes operated.

The estimated profits or commissions received by the suspects based on the accumulated cryptocurrency account transactions are as follows:

• Suspect BAP: Received a total of 53,000 USDT or around Rp890,000,000.00, with 142 transactions from February 2025 to January 2026.

• Suspect RW: Received a total of 42,300 USDT or around Rp700,000,000.00, with 114 transactions from July 2025 to January 2026.

• Suspect FN: Received a total of 14,100 USDT or around Rp235,000,000.00, with 61 transactions from July 2025 to January 2025.

• Suspect WTP: Received a total of 32,700 USDT or around Rp530,000,000.00, with 43 transactions from September 2025 to January 2026.

The profits or commissions were routinely exchanged for rupiah every month.

In addition, to operate the SIM boxes sent from China, the perpetrators needed hundreds of SIM cards that had been registered using the NIK (National Identity Number) and data of Indonesian citizens. These SIM cards were obtained from suspect RJ.

Himawan said that the two Chinese controllers are currently being investigated, and their identities have been identified.

“We have also issued an Interpol Red Notice, and we are also in close communication with China because the sender’s address is listed there. We will ensure that the address is indeed correct,” he said.