The Ministry of Communication and Digital (Komdigi) has uncovered a disturbing pattern of fraud wherein unscrupulous sellers are activating SIM cards using their own biometric facial data before selling them to unsuspecting customers. This revelation has sparked significant concerns regarding the integrity of Indonesia’s digital identification systems, consumer protection, and the broader security of personal data in an increasingly connected nation. Despite the implementation of advanced facial recognition technology by all cellular operators for customer registration, this sophisticated modus operandi has managed to bypass established safeguards, leaving consumers vulnerable to potential loss of access and identity-related risks.
The Deceptive Modus Operandi and Its Immediate Consequences
Director-General of Digital Ecosystem at Komdigi, Edwin Hidayat Abdullah, publicly disclosed the findings, explaining the intricate nature of the fraud. According to Abdullah, sellers first activate a SIM card using their own facial biometrics. Once activated, they sell the card to a customer. Crucially, after the customer begins using the number, the fraudulent seller proceeds to "unregister" or otherwise manipulate the registration status of the SIM card. This insidious act effectively severs the legitimate link between the customer and the purchased phone number, as the SIM card is no longer officially registered under the customer’s identity.
The immediate consequence for the customer is a potential loss of access to their mobile number. This is not merely an inconvenience but a significant threat in today’s digital landscape, where phone numbers are intrinsically linked to a myriad of essential services. Banking applications, social media accounts, e-commerce platforms, and even government services often rely on a registered mobile number for verification, password resets, and two-factor authentication. A customer whose SIM card is fraudulently unregistered risks being locked out of these critical digital services, facing significant disruption and potential financial loss. Furthermore, the absence of proper registration under their name makes it exceedingly difficult for customers to prove ownership, complicating any attempts to recover their number or seek redress.
"There are still those who try such tricks," Edwin Hidayat Abdullah stated in an official communication quoted by Selular on Wednesday, July 21, 2026. "The card is activated with their face, then taken by the customer, and after the customer uses it, it is unregistered, leaving the customer at a loss." This direct account from the Komdigi official underscores the deliberate and malicious intent behind these fraudulent activities.
Chronology of the Discovery
The discovery of this illicit practice emerged during a routine inspection conducted by Komdigi officials. On Friday, July 17, 2026, Director-General Edwin Hidayat Abdullah, accompanied by his team, visited a shopping center in Yogyakarta. The purpose of their visit was to assess the practical implementation of biometric registration protocols at points of sale for SIM cards. It was during this on-site verification process that the fraudulent method of activating and subsequently unregistering SIM cards was observed or brought to light. The subsequent public statement by Abdullah on July 21, 2026, served to formally announce the findings and warn the public and industry stakeholders.
Background Context: The Evolution of SIM Card Registration in Indonesia
To fully grasp the gravity of Komdigi’s findings, it is essential to understand the historical context of SIM card registration in Indonesia. For many years, the process of acquiring a SIM card was relatively lax, often requiring only basic identification or even none at all. This ease of acquisition, while convenient for consumers, led to a proliferation of unregistered SIM cards. This unregulated environment became a fertile ground for various illicit activities, including spam calls, fraudulent text messages (SMS scams), and even more serious crimes like terrorism, which utilized anonymous phone numbers for communication.
Recognizing these significant national security and public order threats, the Indonesian government, primarily through Kominfo (the predecessor to Komdigi in many functions), initiated a mandatory SIM card registration policy. Initially, this policy, largely enforced from 2017 onwards, required customers to register their SIM cards using their National Identity Card (NIK) and Family Card (KK) numbers. While this significantly improved traceability, it still presented loopholes, such as the use of other people’s NIK/KK data without their consent, or the registration of multiple SIMs under a single identity without proper oversight.
The introduction of biometric registration, particularly facial recognition technology, represented the next significant leap in securing the SIM card ecosystem. The aim was to create a truly unique and verifiable link between a SIM card and its actual owner, leveraging advanced technology to confirm identity in real-time. This system was designed to prevent individuals from registering multiple SIM cards under false pretenses or using stolen identities, thereby bolstering consumer protection and national security. All major cellular operators in Indonesia, including Telkomsel, Indosat Ooredoo Hutchison, XL Axiata, and Smartfren, have invested heavily in implementing these biometric registration systems across their sales channels. Komdigi’s latest findings, however, expose a critical vulnerability where human elements can exploit the system despite the technological advancements.
Supporting Data: The Scale of Indonesia’s Mobile Market and Digital Economy
Indonesia boasts one of the largest and most dynamic mobile markets in Southeast Asia. With a population exceeding 270 million, mobile phone penetration is exceptionally high, often exceeding 100% due to many individuals owning multiple SIM cards. As of recent data, there are hundreds of millions of active cellular subscriptions across the archipelago. This immense scale underscores the critical importance of a robust and secure SIM card registration system.
The digital economy in Indonesia is booming, projected to reach significant valuations in the coming years, driven by e-commerce, ride-hailing, online financial services (fintech), and digital entertainment. Each of these sectors relies heavily on the integrity of mobile phone numbers for user authentication, transaction security, and communication. Any compromise to the foundational layer of SIM card registration can therefore have cascading negative effects across the entire digital ecosystem, potentially eroding consumer trust and hindering economic growth. The widespread adoption of mobile banking and e-wallets, for instance, makes the security of a user’s registered phone number paramount to their financial well-being.
Official Responses and Regulatory Directives
Edwin Hidayat Abdullah unequivocally stressed the fundamental principle that SIM cards must be registered using the genuine identity and biometric data of the actual owner. He highlighted that the use of another person’s face for activation renders the user’s identity inconsistent with the registration data, thereby creating a fraudulent record. "These are practices in the field that must be observed. We are now in an era of honesty; what we use must be in our name," Abdullah emphasized, signaling Komdigi’s zero-tolerance stance on such deceptive practices.
The Director-General further stated that the effective implementation of biometric registration necessitates collaboration from all stakeholders. This includes cellular operators, retail partners, and consumers themselves, all working in concert to ensure the process is transparent and adheres strictly to existing regulations. While Komdigi’s inspections have indicated that a majority of parties are compliant with biometric registration requirements, Abdullah acknowledged that some non-compliant entities persist. He did not provide specific figures regarding the proportions but expressed optimism for future improvements. "More are compliant than not, but we hope that the non-compliant ones will gradually disappear, and we can operate even better," he concluded.
Komdigi’s message implies a multi-pronged approach to tackling this issue. Firstly, a clear directive to cellular operators to enhance oversight of their distribution channels, including independent retailers and resellers. Operators are expected to implement stricter vetting processes for their partners, provide comprehensive training on registration protocols, and conduct regular audits to identify and rectify non-compliance. Secondly, there is an implicit call for law enforcement to investigate and prosecute individuals and entities engaged in such fraudulent activities, potentially under existing laws related to electronic information and transactions (UU ITE) or consumer protection. Thirdly, public awareness campaigns are crucial to educate consumers on the importance of verifying their SIM card registration and reporting suspicious practices.
Broader Impact and Implications for Digital Trust
The discovery of SIM card biometric misuse carries significant broader implications beyond the immediate loss experienced by individual customers.
1. Erosion of Consumer Trust: This fraud directly undermines public trust in digital systems and the security measures put in place by both government and private entities. If even a fundamental service like SIM card registration, backed by advanced biometrics, can be circumvented, it raises questions about the security of other digital identification and authentication processes.
2. Data Security and Privacy Concerns: While the article focuses on the immediate loss of access, the misuse of biometric data, even if it’s the seller’s own, highlights vulnerabilities. It could potentially open doors for more sophisticated identity theft if, for instance, the unlinked numbers are then used to register other services under false pretenses or sold to third parties for illicit activities. The core principle of "one person, one identity, one registered number" is compromised.
3. Regulatory Enforcement Challenges: The incident underscores the perennial challenge of enforcing regulations across a vast and fragmented retail landscape. Even with robust policies and technological solutions, human elements seeking to exploit loopholes remain a constant threat. Komdigi and operators must continually adapt their enforcement strategies to stay ahead of evolving fraudulent tactics. This might include real-time monitoring of activation/deactivation patterns, advanced analytics to detect anomalies, and more frequent, unannounced inspections.
4. Impact on Digital Economy Growth: A secure digital identity is foundational to the growth of Indonesia’s digital economy. If users cannot trust the security of their primary digital identifier (their phone number), their willingness to engage in online transactions, banking, and other digital services may diminish. This could inadvertently stifle innovation and slow down the country’s digital transformation agenda.
5. Call for Stronger Collaboration and Accountability: This situation necessitates a renewed commitment from all stakeholders. Cellular operators must take greater responsibility for the actions of their sales channels. Retailers and their employees must be held accountable for adhering to regulations. Consumers, too, have a role to play by being vigilant and ensuring their SIM cards are correctly registered in their name and reporting any suspicious activity. Komdigi’s emphasis on an "era of honesty" reflects the need for a collective ethical upliftment across the entire value chain.
In conclusion, Komdigi’s uncovering of SIM card biometric misuse by sellers is a critical development that demands immediate and comprehensive action. It serves as a stark reminder that technological advancements in security must be accompanied by rigorous enforcement, continuous vigilance, and a shared commitment to integrity across the digital ecosystem. The future of Indonesia’s digital trust and consumer protection hinges on effectively addressing such vulnerabilities and ensuring that the promise of secure digital identity is fully realized.
