Scams on Bali's classified ads split into two families, depending on who loses the money. On the buyer's side: manufactured urgency, a deposit demanded before any viewing, an item that does not exist, stolen goods priced far below the market, a QR code that opens a fake payment page. On the seller's side: a fake transfer receipt (a screenshot, nothing more), an overpayment followed by a request to refund the difference, an account hijacked through a verification code sent by SMS. Both camps share one opening move: getting the conversation off the site's own messaging.
No publicly accessible Indonesian statistic isolates "classified ad" fraud. The only hard figure available is the cumulative tally of the Indonesia Anti-Scam Centre (IASC), run by the OJK and dated 14 July 2026: 608,167 reports received, more than a million bank accounts named in those reports, 557,751 accounts frozen and close to 200 billion IDR returned to victims — all financial fraud combined. If the transfer has already gone out, the official channels are the IASC, the OJK's 157 line, the national police on 110 and the SP4N-LAPOR portal (verification within 3 days, an answer from the administration within 5).
What the official numbers say — and what they don't
The only recent, solid document is press release SP 139/DKPU/OJK/VII/2026 of 14 July 2026 from the Otoritas Jasa Keuangan (OJK), Indonesia's financial regulator. It publishes the tally of the IASC, the national anti-scam desk. Three warnings before you quote it:
- The figures are cumulative, from a starting date the release never gives. They describe a total as at 14 July 2026, not a year of activity: nobody can turn them into a "2026 volume".
- They cover all financial fraud: investment schemes, bogus loans, bank impersonation. Nothing in them isolates deals between private individuals.
- The other numbers in the release concern online gambling (judol): 2.8 million customer relationships refused by banks, 51,200 closed, 32,454 accounts frozen after enhanced due diligence (up to May 2026), and suspicious transaction reports tagged "online gambling" up 260.03% on 2025. Recycling those as classified-ad scam statistics would be a fabrication.
| What is measured | What isn't |
|---|---|
| IASC cumulative tally at 14/07/2026: 608,167 reports, 557,751 accounts frozen, ~200bn IDR returned | The volume of classified-ad scams in Indonesia |
| Account freezes linked to online gambling (up to May 2026) | Scams on Bali classified ads specifically |
| Timelines published by SP4N-LAPOR: 3 days to verify, 5 days to answer, 10 days to reply | An official deadline for reporting fraud to the IASC (none is published) |
| Entities blocked by Satgas PASTI: 824 — but over April–May 2024 | A 2026 equivalent of that figure on the official page |
On prevalence, the sources disagree, and they must never be added together. Avast, the security vendor (page updated 8 September 2025), quotes an FTC study: among people who reported losing money to fraud since 2021, one in four traces the start of the scam to social media. ESET (7 July 2022) reports that one respondent in six (17%) in a survey said they had come across a scam on Facebook Marketplace. Different populations, different questions, different years — and the "one in four" reaches us second-hand, through Avast: the FTC's primary source cannot be consulted.
Bali adds a local bias: petty crime is under-reported. A Coconuts Bali feature (21 December 2020 — context, not current data) set out why: distrust of how effective the police are, fear tied to immigration status, a wish to protect the island's tourist image. Its example: a burglary in an Ubud villa, 14 million IDR of equipment taken (about 993 USD). The real volume of private-sale scams on the island is therefore, by construction, invisible.
Buyer side: the best-documented techniques
Three security-vendor taxonomies are the reference here: Avast (8 September 2025), Panda Security (29 March 2024) and ESET WeLiveSecurity (7 July 2022). They cover Facebook Marketplace, they overlap heavily, and they describe mechanisms that hold for any private sale. These are the ones that transfer straight across to Bali's second-hand market — scooters, villa furniture, surfboards, electronics, rentals.
| Technique | What it looks like | The counter |
|---|---|---|
| Manufactured urgency | "Another buyer is coming tonight", payment demanded on the spot | No payment before you have seen the item; the urgency is the signal |
| Deposit or holding fee before viewing | "I'll hold the villa / the scooter for you" | No remote deposit, no exceptions |
| Item that doesn't exist | Vehicle, home or electronics never shown in the flesh | Physical viewing, or a video call with the item on screen |
| Stolen goods, priced to move | Abnormally low price, "leaving in a hurry, everything must go" | Check the paperwork and the ID of whoever holds it |
| Counterfeit sold as genuine | Luxury label at a knock-down price: clothes, perfume, jewellery, cosmetics | Compare with the market price: a huge gap rarely has a good explanation |
| Faulty item passed off as new | Seller unreachable the moment the money lands | Test the item in front of the seller, before paying |
| Bait & switch | The attractive item turns out to be "unavailable", you get pushed towards a pricier one | Walk away: the switch is the whole method |
| Fake profile, phishing link | A link sent "to confirm" or "to pay" | Never enter your credentials from a link you were sent |
| Fake payment QR code | A QR sent in a message that opens a fake payment page | Scan a QR displayed at the till, never one sent by a stranger |
| Fake competition, fake lottery | Personal data harvested in exchange for a "prize" | No bank details to "win" anything |
| Fake shipping or insurance fee | A delivery invoice to settle before you receive a thing | You see the item and pay on the spot, or not at all |
Two things specific to Bali
Cash and money changers. A lot of private deals settle in cash, often after a stop at a money changer. On 25 March 2026, The Bali Sun spelled out the two ways unlicensed counters fleece their customers: a misleading advertised rate, and a short count handed over at the window. The response announced: the moneychangerbali.com portal to identify a licensed counter, a five-year eradication plan led by APVA Bali, and an awareness campaign with the traditional villages of Kuta, Legian and Seminyak. Until then: recount at the window, before you walk out.
Bank cards. Government travel advice puts it in plain words. France's foreign ministry page on Indonesia (France Diplomatie, updated 30 June 2026) states that cases of bank card fraud have been reported and that great caution is required with this method of payment — never let the card out of your sight. The same page flags a rise in snatch thefts in tourist areas of Bali, Lombok and Jakarta, along with cases of spiked drinks followed by theft. Whatever passport you hold, the advice travels: worth remembering before you agree to an evening meeting, in a place the other person chose.
On a vehicle, checking the paperwork remains the real filter: our guides on the traps of buying a used scooter and on the STNK, the BPKB and the annual road tax set out what to look at before a single note leaves your pocket. On a yearly rental, the deposit before viewing is the great classic: the real prices by neighbourhood give you the benchmark that exposes an offer that is too good.
Seller side: the fake transfer receipt and its relatives
You feel safe when you are the one taking the money. The central technique is documented by Avast: the buyer sends a screenshot of a transfer "already made" and asks for the goods. The screenshot costs nothing to produce; the item, on the other hand, leaves for good.
The defence fits in one sentence: a receipt is not a payment. Until the amount shows up in the balance of your own banking app, nothing moves — not the scooter, not the sofa, not the laptop. "My bank takes a few hours" changes nothing: your balance decides, not the word of the person in front of you.
| Seller-side technique | What it looks like | The counter |
|---|---|---|
| Fake proof of payment | Screenshot of a transfer "already sent" | Hand the item over only once the credit shows in your account |
| Overpayment | Payment above the agreed price, then a request to refund the excess | Refuse outright: the original payment is usually reversed afterwards |
| Stolen bank card | Buyer in a hurry, indifferent to price, sometimes paying over the odds | Take payment by an irreversible means: a cleared transfer, or cash counted on the spot |
| Chargeback | Payment disputed after the item has been received | Keep every written trace, and proof of handover |
| Fake escrow, fake courier | A "trusted" provider imposed by the buyer | Refuse any intermediary chosen by the other party |
| Fake prepaid shipping label | The buyer supplies the shipping label themselves | Your courier, or hand delivery |
| "The parcel never arrived" | A claim made after a shipment that genuinely happened | Insist on signed proof of delivery |
| Verification code (OTP) theft | "Send me the code you just got by SMS to confirm" | Never pass on a code received by SMS, to anyone |
| Moving off the platform | A request for your personal number, a switch to a third-party app | Stay in the site's messaging until the sale is done |
| Ship before you are paid | "Send it, I'll pay on delivery" | Money first, shipping second |
Overpayment appears in black and white among the warning signs listed by Scamwatch, the Australian government's anti-scam service: "A buyer sending a cheque or payment that is more than the agreed price and asking you to refund the overpaid amount." Two more signals from the same page apply in Bali: the buyer who commits to an expensive item without ever coming to see it, and the one who wants to pay "in unusual ways" — money order, prepaid card, or several different payment IDs.
The verification code deserves a stop of its own. Avast, Panda Security and ESET describe the same scenario to within a few words: on the pretext of "verifying your identity" or "completing the transaction", the buyer asks you to pass on a code received by SMS. That code verifies nothing — it is used to create or hijack an account in your name. No buyer, no platform and no bank needs a code sent to your phone.
Why so many scams start with "shall we carry on over WhatsApp?"
Run back through both tables: a good share of these techniques requires getting off the site's messaging first. Panda Security duly files insistence on leaving the platform among the warning signs. The reason is mechanical.
- Inside the site's messaging, the exchange is timestamped and kept: that is your evidence in a dispute.
- Outside it, all that remains is a conversation in a third-party app, a burner number and no moderation to appeal to.
- The scammer's account can vanish overnight; the listing and the conversation stay reportable — provided the exchange actually took place on the site.
Avast draws a simple rule from this: stay in the internal messaging so the history survives, and use only reliable, traceable payment methods. Picking up the phone is not forbidden, but the price, the conditions and the commitments should leave a written trace in the platform's own tool.
On Lokalfinds, that comes down to three buttons: Report this listing, Report this profile and Report this message, each with a reason dedicated to fraud ("Scam or fraud attempt") and a stated review within 48 hours by the moderation team. One precise report — date, amount, screenshot — is worth ten outraged ones. On the selling side, a well-written listing already screens out part of the dubious traffic: our five tips for selling fast double as a first filter.
The money has gone: what to do, and in what order
The Indonesia Anti-Scam Centre portal hammers home a single message: speed. Scammers move funds within minutes, from account to account — an hour's delay is often enough for the first account to be empty. That said, no official maximum window is published: the deadlines that circulate in expat groups appear on no official page.
The IASC form asks for five blocks of information. Have them ready before you start:
1. Your identity as the person reporting: name, place and date of birth, nationality, occupation, phone, email.
2. A scan of your ID in PDF, JPG or PNG, 1 MB maximum.
3. The identity of the party you are reporting: name, phone, account number.
4. The circumstances and the transaction details: both account numbers, the amount, the exact timestamp.
5. Consent to the processing of your data. If you are reporting on someone else's behalf: a power of attorney (2 MB max) and the victim's ID (1 MB max).
| Body | What it is for | Contact | Published timeline |
|---|---|---|---|
| IASC (OJK) | Report a fraudulent transaction; reports feed the account freezes | iasc.ojk.go.id | No published deadline — act immediately |
| OJK — consumer service | Questions on financial products, reporting fraud and illegal financial activity (APPK portal) | 157 · 081 157 157 157 · konsumen@ojk.go.id | Not published |
| Polri | Entry point for the national police | Call centre 110 | Not published |
| Dumas Presisi (Polri) | Online complaint, including against officers | dumaspresisi.polri.go.id · WhatsApp 0878-8008-0001 | Not published |
| SP4N-LAPOR! | Administrative complaint, one window across all agencies | lapor.go.id | Verification 3 days · answer 5 days · citizen's reply within 10 days |
Three caveats before you dive in. Dumas Presisi is not a desk dedicated to online fraud: it is the national police's general complaints channel, including complaints against its own officers, and access to the portal runs through Google Authenticator. For a conventional criminal complaint, the route is still the police station (Polres) — check the procedure on 110, not on a Facebook group. SP4N-LAPOR is not uniform: more than 700 institutions are still running version 3.5 against 10 migrated to 4.0, and attachments are capped at 2 MB. Finally, two services often mentioned among expats — a bank account verification portal and a cybercrime reporting desk — do genuinely exist, but we were unable to consult the exact procedure: ask your bank, or call 157.
Then there is the legal ground, where improvising does not pay: criminal classifications, limitation periods and civil remedies are not settled from a blog post. For anything beyond reporting, go through the OJK, the police or local legal counsel.
Frequently asked questions
How do I check that a transfer has really arrived before handing over an item?
By opening your own banking app and seeing that the balance has moved. A screenshot sent by the buyer proves nothing: Avast documents this exact technique, where the buyer claims to have paid, sends a receipt and asks for the goods. Neither a reference number nor a forwarded confirmation email is a substitute for the money actually landing in your account.
A buyer is asking for a code I received by SMS to "confirm": is that legitimate?
No, never. Avast, Panda Security and ESET all three describe this scenario: the code is used to create or hijack an account in your name, not to verify anything. No buyer, no platform and no bank needs a code sent to your phone. If the request comes, end the conversation and report the profile.
What should I do in the first minutes after transferring money to a scammer in Bali?
Report the transaction immediately to the Indonesia Anti-Scam Centre (iasc.ojk.go.id) and call the OJK on 157. The IASC portal explains that funds are moved within minutes through a chain of accounts: a freeze only stands a chance if it happens very early. Have both account numbers, the amount, the exact timestamp and a scan of your ID under 1 MB ready to go.
Which documents do I need to report a fraudulent transaction to the IASC?
Five blocks: your identity (name, place and date of birth, nationality, occupation, phone, email); a scan of your ID in PDF, JPG or PNG, 1 MB maximum; the identity of the party you are reporting; the circumstances and the transaction details (both accounts, the amount, the timestamp); and your consent. To report on someone else's behalf: a power of attorney of 2 MB maximum and the victim's ID (1 MB).
Are there scam statistics specific to classified ads in Bali?
None that we could find. Neither the OJK nor the national police publish a "private sales" breakdown that is accessible online. The IASC tally dated 14 July 2026 — 608,167 reports, 557,751 accounts frozen, close to 200 billion IDR returned — covers all financial fraud and remains cumulative, with no start date. Extrapolating a local figure from it would be invention.
Why is a buyer who insists on moving to WhatsApp a warning sign?
Because the site's messaging timestamps and keeps the exchange: that is your evidence in a dispute. Panda Security files insistence on leaving the platform among the seller-side warning signs. Once you are outside, all that is left is a burner number, no usable trace and no moderation. Negotiate in the internal messaging, then phone afterwards to fix the meeting if you like.
A buyer pays more than the agreed price and asks for a refund: what should I do?
Refuse, return the money through the same channel if it genuinely arrived, and report the profile. Scamwatch, the Australian government service, lists this case explicitly among the seller's warning signs: the original payment is frequently reversed after you have refunded the excess, and you lose both amounts. No honest buyer has any reason to pay more than the asking price.
Sources
- OJK — press release SP 139/DKPU/OJK/VII/2026, 14 July 2026 (official) — cumulative IASC tally and banking figures tied to online gambling.
- Indonesia Anti-Scam Centre (OJK) (official) — reporting procedure, documents required, urgency of the process.
- OJK — APPK consumer portal (official) — channels 157, 081 157 157 157, konsumen@ojk.go.id.
- OJK — Satgas PASTI (official) — reporting illegal financial activity; the figure shown dates from April–May 2024.
- SP4N-LAPOR! (official) — administrative complaints, 3 / 5 / 10-day timelines, attachments of 2 MB maximum.
- Polri and Dumas Presisi (official) — 110 call centre, online complaints, WhatsApp hotline 0878-8008-0001.
- France Diplomatie — Indonesia, security (30 June 2026) (official) — French foreign ministry travel advice: bank card fraud, thefts in tourist areas, spiked drinks.
- Scamwatch, Australian government — Buying or selling (official) — seller-side warning signs, overpayment included.
- Avast — Facebook Marketplace scams (8 September 2025) (commercial) — buyer/seller taxonomy, fake receipt by screenshot, verification code theft, second-hand FTC statistic.
- Panda Security — 18 Marketplace scams (29 March 2024) (commercial) — urgency and moving off the platform, signed proof of delivery.
- ESET WeLiveSecurity (7 July 2022) (commercial) — fake shipping and insurance fees, code hijacking, the "one in six" statistic.
- The Bali Sun (25 March 2026) (press) — rate and short-count scams in Bali's money changers.
- Coconuts Bali (21 December 2020) (press) — context on the under-reporting of crime in Bali.
