A scam hold is part of the product, not an apology
When customers are deceived into authorising a transfer, fraud systems see nothing wrong. Banks should design deliberate friction into the moments where scams concentrate, accept the commercial cost and share losses through a published rule instead of case-by-case goodwill.
The most expensive fraud problem at my bank is one our fraud systems were never built to see. A customer, on their own phone, logged in with their own credentials, sends money they have chosen to send. They have been deceived, sometimes by a message carrying a malicious file, sometimes by a caller who sounds exactly like one of our staff. The transaction is authorised in every technical sense. My position is that banks should stop treating these losses as a customer-education problem with a complaints process attached, and start treating them as a design problem: deliberate friction at the moments where scams concentrate, paid for in convenience and volume, with a published rule for sharing losses when the bank's own controls failed.
The transfer that looked normal to every system
In 2023, 6,400 Kartadana customers reported losing a combined Rp 87 billion to scams. When our fraud team reviewed a sample of 300 cases, the pattern was consistent. In most of them a new device had been registered to the account within the previous day, either because a scammer had taken control of the account or because the customer had been talked into setting up a new phone. The first transfer to a new beneficiary followed within hours, and it was usually large compared with the customer's normal payments. The money arrived in an account, at another bank or at ours, that had been opened weeks earlier by someone paid to lend their identity, and it left again within minutes.
Our rules had been tuned to catch stolen cards and compromised passwords. They looked for transactions the customer had not made. In these cases the customer had made them. Each element on its own, a new phone, a new payee, a large transfer, was ordinary. Customers change phones, pay new suppliers and make large payments every day. What was unusual was the sequence within a short time, and our systems did not treat sequences as risks.
The response banks usually reach for is education: warnings in the app, messages about never sharing codes, posters in branches. We do all of that and I would not stop. But education asks the customer to recognise a deception at the very moment it is working on them, often under pressure from someone who sounds official and urgent. Expecting a sixty-year-old trader to resist a rehearsed caller in that moment, and blaming her when she does not, is not a control.
Friction placed where the scam happens
From February 2024 we held the first transfer above Rp 5 million to a new beneficiary, made within twenty-four hours of registering a new device, for four hours while one of our team called the customer. We stopped the app from running if an unknown application had been given permission to read the screen or control the phone. We added biometric matching against population-registry data and device checks at account opening, to make it harder to open the accounts that receive stolen money. Each of these is aimed at a step in the sequence, not at the customer's general behaviour.
The call matters more than the delay. Seventy-one per cent of the transfers we held in 2025 were cancelled by the customer after speaking to us, often after a pause in which the customer realised what the caller had asked of them. Four hours is long enough for that pause and short enough for most legitimate payments to wait.
The friction cost us. Our app rating fell from 4.5 to 3.9 over five months, mainly because of customers who resented the hold. Transfer volumes fell 6% for two months as some customers moved payments elsewhere. Merchants paying suppliers were the angriest, because we applied the hold to long-standing business accounts as bluntly as to new retail customers, a mistake we later corrected by tiering the rule. Our director of digital banking had warned of all this. He was right about the cost and, I believe, wrong about whether it was worth paying.
By 2025 reported scam losses had fallen to Rp 26 billion across about 2,500 cases, and the number of accounts at Kartadana receiving scam proceeds had fallen from 11,200 to 3,900. I do not attribute all of that to our controls. Scams move to wherever controls are weakest, and some of the decline at our bank will have reappeared at others. That is the strongest argument for common industry practice on where friction belongs, and for shared data on mule accounts, which OJK has encouraged banks to build together.
Who carries the loss when a customer was deceived
The hardest question is reimbursement. Our legal team's concern was reasonable: a bank that pays one customer may be asked to pay all of them, and an authorised transfer is, in law, the customer's own instruction. Before 2024 we decided cases individually, which meant the outcome depended on how persistent the customer was and which manager happened to read the file.
We now publish a framework. Where our own controls failed, for example when a hold should have applied and did not, or when a mule account had been opened at Kartadana despite warning signs our checks should have caught, we reimburse in full. Where the customer overrode a specific warning given in our call, we do not. Between those cases the framework sets out what we consider and how a customer can ask for a review. We reimbursed Rp 14.2 billion in 2024 and 2025, and the published rule has reduced disputes rather than multiplied them, because customers can see how a decision was reached.
I understand why some bankers resist this. Reimbursement can be framed as rewarding carelessness, and the cost appears open-ended. My answer is that a published rule limits the cost better than discretion does, and that a bank which must pay when its controls fail has a direct reason to fix them. Our quarterly report to the Risk Monitoring Committee now shows scam losses, reimbursements and the complaints our controls create side by side, so that directors can weigh the harm prevented against the inconvenience imposed.
If I could put one question about scams to every bank board, it would be this: at which step in the scam sequence does our bank add friction, and what is that costing us? A board that hears only about awareness campaigns has been told what the bank hopes customers will do, not what the bank has chosen to do itself.