Skip to content
Indonesia Knowledge
scams

ATM and card scams in Indonesia

Card skimming, shoulder surfing, card-retention scams and 'helpful stranger' tricks. How to use ATMs safely in Bali, Jakarta and beyond.

3 min read

Card skimming is the most consistent ATM scam in Indonesia, with hotspots in Bali (Kuta, Legian, Canggu), Jakarta (some neighbourhood ATMs), and tourist towns generally. The fraud usually appears 24-72 hours after the withdrawal as small test charges followed by larger ones. Prevention is straightforward.

The recurring patterns

1. Skimmer + camera on quiet ATMs

What happens: skimmer overlay reads your card; pinhole camera or shoulder-surfing captures your PIN. Fraud charges appear on your account within hours to days.

Hotspots: standalone kiosk ATMs (in convenience stores, small shops). Less common at bank-branch ATMs in proper bank lobbies.

Prevention:

  • Use ATMs inside actual bank branches (BCA, Mandiri, BNI, CIMB Niaga). Major branches in Denpasar, Jakarta CBD, central Yogyakarta are safest.
  • Cover the keypad with your free hand when entering PIN
  • Wiggle the card slot before inserting — skimmers often feel loose
  • Check your bank app daily during the trip

2. Shoulder surfing at busy ATMs

What happens: someone in line is unusually close, watches you enter PIN, then either grabs your card after withdrawal or follows you afterward.

Prevention: insist on personal space at the ATM. If the line is uncomfortable, leave and try another.

3. The "helpful stranger" at a malfunctioning ATM

What happens: ATM appears to malfunction (your card stays in, your money doesn't come out). A friendly local approaches: "I had this happen, just press cancel three times." Their tip ejects your card — into a hidden device. Or they distract you while a partner swaps your card with a similar-looking one.

Prevention: don't accept ATM help from strangers. If your card is retained, immediately:

  1. Call your home bank to block the card
  2. Take a photo of the ATM screen and surroundings
  3. Report at the bank branch (if at one) or note the ATM ID for the report

4. Cash-trap inserts

What happens: a thin plastic device is inserted in the cash slot; your money is trapped behind it. You leave assuming the ATM is broken. The scammer retrieves your cash later.

Prevention: if cash doesn't dispense as expected, don't leave the ATM. Contact the bank immediately.

5. Card swap at point of sale

What happens: at a restaurant, dive shop or villa booking, you hand over your card. It's quickly swapped with a similar-looking dummy card. You sign for the legitimate transaction, take the wrong card home, and the original is then used elsewhere.

Prevention: keep visual contact with your card. Verify the returned card is yours before leaving.

6. QRIS payment-spoofing

What happens: rare but emerging — a fake QRIS sticker overlaid on a legitimate one routes payments to a scammer's wallet.

Prevention: prefer card payment at unfamiliar venues. For QRIS, verify the displayed merchant name in your bank app before confirming.

7. "Bank security" phone scam (mostly affects KITAS holders)

What happens: caller claims to be from your Indonesian bank's "security department" needing your card details or OTP to "verify a suspicious transaction."

Prevention: banks never ask for full card details, OTP, or PIN by phone. Hang up and call back via the number on the back of your card.

What to do if you've been hit

  1. Block the card immediately via your home-bank app or by phone
  2. Document: time, ATM ID, photos of surroundings
  3. File a police report at tourist police office (needed for some insurance claims)
  4. Notify your home bank with the report number
  5. Check transactions daily for the next 30 days
  6. Replace the card through your bank — most ship internationally to Indonesia (4-7 days)

How to limit exposure

  • Withdraw larger amounts less frequently (less ATM exposure)
  • Keep a backup card stored separately from your wallet
  • Use Wise/Revolut as travel cards (low-balance, easy freeze if compromised)
  • Don't use the same card for ATMs and online transactions
  • Enable transaction notifications on all cards

Verification

For current ATM safety patterns, ask your home bank's fraud team and check current local-expat group threads. Tourist police (Bali): +62 361 224 111.

Related reading

FAQ

Are Indonesian bank ATMs themselves safe? The machines are fine — the issue is skimmers attached by criminals. Bank-branch ATMs are checked regularly; standalone ATMs less so.

Will my home bank cover skimming losses? Most major banks (Chase, HSBC, Lloyds, Westpac, BMO, etc.) refund unauthorised transactions if reported promptly. Confirm with your bank's policy.