The first BI-FAST fraud in Indonesia: Rp100+ billion in 3 hours

Overview

In a span of three hours, more than Rp 100 billion left a BI-FAST participant bank through a routine that looked legitimate to the national payment system.

DFI was appointed to investigate and reconstruct the perpetrators' movements. The weakness was not in BI-FAST itself, but in the bank-side systems connected to it. The reconstruction led to apprehension within weeks, making this one of the most significant payment fraud cases in Indonesia.

Attack chain

In 6 steps, reconstructed from forensic evidence.

1

Access through an unintended environment CONFIRMED

2

Credentials observed HARVESTED

3

System activity initiated TESTED

4

Controls evaded EXECUTION

5

Unauthorised BI-FAST transfers IMPACT

6

Funds laundered DISPERSED

Actor

Actor type Organised syndicate with direct insider ties.

Motivation Financial (large-scale extraction).

Capability Advanced financial system integrity with technical know-how in host/network administration.

TTP: how the attack worked

Mapped to MITRE ATT&CK for Enterprise, with tactical execution detail.

Initial Access

Credential Access

Execution

Lateral Movement

Impact

IoC: what to look for

Behavioural indicators that can be turned into monitoring rules. Match to system behaviours, not just static signatures.

TRANSACTION MONITOR

Network connection hitting pattern threshold on non-facing bank IP connections.

SUSPICIOUS TIMELINE

A sudden spike in outgoing BI-FAST transfers outside normal settlement windows.

SUSPICIOUS PATTERN

Many new beneficiary accounts appearing in the same short time frame.

ANOMALOUS ACTIVITY

Unscheduled access to the servers connecting the bank to BI-FAST.

Detailed indicators are confidential.

The first BI-FAST fraud in Indonesia: Rp100+ billion in 3 hours. We solved it.

Overview

Attack chain

Actor

TTP: how the attack worked

IoC: what to look for

When the system says everything is fine, the evidence may say otherwise.

Talk to DFI in confidence