Cyber Crime Directorate at the Bali Regional Police successfully dismantled a personal data theft syndicate controlled from Cambodia.
The raid was conducted on Friday, July 4, 2025, at a residence located at Jalan Batas Dukuh Sari, Gang Cendrawasih No. 12, Sesetan Village, South Denpasar. Six suspects were apprehended, while two others remain fugitives.
During the operation, officers seized evidence including three tablet units, 12 mobile phones of various brands, and 15 additional mobile phones pre-registered with mobile banking accounts from different banks.
Authorities also confiscated 60 new smartphones (Samsung and Xiaomi Redmi), several ATM cards from 3 Indonesian banks, and 5 notebooks containing customer order records.
The Director of Cyber Crime at Bali Police, Commissioner Ranefli Dian Candra, explained the roles of the arrested individuals. CP (43) acted as the coordinator, assisted by RH (42), NZ (21), FO (24), and PF (33) who worked as marketers. Two women, SP (21) and another NZ (21), served as administrators and marketing personnel.
Authorities are still searching for two additional suspects: AW alias M—believed to be the mastermind of the syndicate and currently located in Cambodia—and a suspect identified as S, who was responsible for sending mobile phones already registered with mobile banking to M in Cambodia.
Commissioner Ranefli stated that the group collected citizens’ personal information, such as Indonesians’ ID cards and family cards in order to create online bank accounts. They specifically targeted individuals from lower economic backgrounds.
According to Fajarbali,“Victims were offered Rp 500,000 for each bank account,” he said during a press conference on Wednesday, July 9, 2025.
The registered accounts were not used by the victims but were instead sent to Cambodia for online gambling operations. Some were used to receive gambling funds, while others were used directly by gamblers.
Commissioner Ranefli said the network’s origin traces back to a reunion between two old friends, CP and M, around September 2024. At the time, M was vacationing in Bali from Cambodia, while CP, who worked as a fabric trader, shared that his business had declined since the COVID-19 pandemic.
“M immediately taught him the method and offered CP Rp 1 million for each bank account,” Ranefli said.
Initially, CP worked alone. Later, he recruited six individuals, including the five suspects who have now been arrested. Each received Rp 500,000 for every account created. Since September 2024, the group reportedly earned hundreds of millions of rupiah from the scheme involving hundreds of bank accounts.
“The perpetrators persuaded people to open bank accounts in exchange for Rp 500,000 each. Victims were assured the accounts would not be used for criminal activity. Some were told the accounts were for trading purposes, or that entrepreneurs needed them,” he said.
“With such offers, it’s not surprising that some agreed. The perpetrators didn’t use force, but they knew who could be persuaded,” added the former Tabanan Police Chief.
As of the latest update, investigators have questioned three individuals whose personal data was exploited. They admitted to being lured into opening accounts in exchange for Rp 500,000. Once they agreed, marketing staff guided them through the online registration process.
Although there have been no confirmed financial losses, one witness reported being contacted by a bank regarding suspicious activity in their account. Upon reflection, the victim remembered that the account was one they had previously opened at the request of a stranger.
According to Nusabali, “We urge the public not to share personal data easily,” Ranefli emphasized. He advised citizens to safeguard sensitive information such as ID cards, family cards, bank account numbers, and ATM PINs—especially from strangers.
“All the victims they targeted were located in Bali. Most of them were economically disadvantaged,” he concluded.
The suspects are being charged under Article 65(1) and Article 67(1) of Law No. 27 of 2022 on Personal Data Protection, which prohibits the unauthorized collection of personal data for personal or third-party gain and can result in up to five years in prison. They are also charged under Article 55 of the Indonesian Criminal Code for participation in a criminal act.