Every tax reporting season, there is usually an increase in cases of fraud committed in the name of the Directorate General of Taxes (DJP). The following are critical periods when this type of fraud often occurs:
- January – March: An increase in the number of fraud cases targeting Individual Taxpayers, coinciding with the tax return filing (SPT) deadline on March 31.
- April: An increase in the number of fraud cases targeting Corporate Taxpayers, as the deadline for corporate tax return filing (SPT) is April 30.
- Policy Transition Period: When there are major system or data updates, such as the implementation of the Coretax system or updates to Taxpayer Identification Number (NPWP) data.
- Year-end: The emergence of schemes related to tax arrears or threats of asset seizure to meet year-end state revenue targets.
Scammers are becoming increasingly sophisticated by combining psychological manipulation over the phone with the distribution of malicious links or files via WhatsApp to drain victims' account balances.
Chronology of the Latest Tax Fraud Scheme
With the new regulation on tax reporting through Coretax, a new modus operandi has emerged in which the perpetrators claim to be tax officials and use the pretext of synchronizing and re-verifying Coretax data.
- Scammers call their potential victims and claim to be tax officials. To convince them, they mention the victims' addresses and national identification numbers.
- Scammers inform victims that there is a task to “synchronize and re-verify data for the Coretax system update,” which is free of charge, except for a stamp duty fee of IDR 10,000.
- Victims are then asked to check a PDF file containing their tax data sent via WhatsApp. If the data is correct, they are asked to confirm its accuracy.
- A scammer calls via WhatsApp Call and guides the victim to click on the three-dot icon at the bottom left of the phone screen, then select “Screen sharing.”
- The victim is then asked to transfer a stamp duty fee of IDR 10,000 to the account number provided. The purpose is for the scammer to obtain the victim's mobile banking user ID and password.
- A scammer sends a WhatsApp message containing a link resembling the Google Play Store and asks the victim to download the Coretax app. The scammer claims that this app is the latest version that must be installed for data verification.
- The motive is to obtain remote access authorization so that the scammer can view, record, and control the victim's device remotely.
A few moments later, the victim realized that several transactions had taken place and that their account balance had decreased.
Characteristics of Fraud
Keep the following points in mind to distinguish between genuine officials and fraudsters:
- Email and web domain: Directorate General of Taxes (DJP) only uses email addresses with the domain @pajak.go.id and the official website pajak.go.id.
- No links/APK files: Directorate General of Taxes (DJP) never sends links or application installation files via WhatsApp.
- Tax payments: Payments are only made using a billing code through a designated bank or post office, not through transfers to personal accounts in the name of individuals (including stamp duty payments).
- Self-service: Data updates are carried out independently through the official portal or at the nearest tax office, not guided through personal phone calls.
Tips to Avoid Fraud
If you receive suspicious contact, immediately take the following actions:
- Do not reply to messages or follow instructions over the phone. Immediately block the number.
- Never download files or click on links sent by unknown numbers.
- Always keep your personal banking data confidential.
- For Android users, disable the “Accessibility” feature if not in use and install a reputable antivirus program to protect your phone.
- Contact the official Kring Pajak service at 1500200 or visit the nearest Tax Office (KPP).
- If you receive suspicious information related to BCA, immediately contact Halo BCA at 1500888 or via the haloBCA app.
If you suspect that you have been a victim of fraud, report it through the Tax Complaint page or via email at pengaduan@pajak.go.id.
Those are the security tips. We hope you can avoid this type of fraud. For more information on other types of fraud, visit www.bca.co.id/awasmodus.
