A silver car carrying an SMS blaster repeatedly drove slowly back and forth alongside Jakarta’s Mass Rapid Transit (MRT) route between Bundaran HI and Blok M, transmitting smishing messages directly to nearby phones. Police say the operation aimed to send 20,000 messages a day and had been running for around three months.
Jakarta Metropolitan Police disclosed the case on 2 October 2026, two months after officers stopped the car and arrested its driver on 31 July.
The scammers had chosen one of the busiest parts of Jakarta’s metro network. MRT Jakarta’s passenger figures for January 2026 ranked Dukuh Atas, Blok M and Bundaran HI as its three busiest stations, all on the section travelled by the SMS blaster car.
This is not the first SMS blaster to target people using busy public transport. In London, a transmitter concealed in a suitcase was used to send smishing messages to rush-hour Underground passengers. In Tokyo, volunteers tracked an SMS blaster vehicle travelling a route that included the railway between Shinjuku and Shibuya.
Investigators stopped the Jakarta car on 31 July after watching it travel back and forth along the route during rush hour. The driver kept to around 30–40km/h because the SMS blaster had an estimated range of 1–1.5km. Officers found the SMS blaster, amplifier, uninterruptible power supply and battery operating inside the vehicle. Five mobile phones, bank books and ATM cards were also seized.
Four more arrests followed. The other four suspects were accused of recruiting the driver and supplying the vehicle, paying the driver and recruiter, assembling and installing the SMS blaster, and controlling the content and volume of messages. Police said the suspect who paid the driver and recruiter bought the SMS blaster equipment online from overseas and imported it into Indonesia under the description “amplifier”.
The gang also mapped other busy locations and times. Investigators said they concentrated on the morning and evening rush hours and lunchtime, targeting railway and metro stations and shopping centres where large numbers of people gathered. The fake BTS could be configured to transmit on the frequency of a particular mobile provider.
The messages impersonated banks, telecoms providers and other businesses, including coffee shops. Some claimed that loyalty points were about to expire and directed recipients to imitation websites that requested credit-card details.
Investigators said the criminals hoped that one or two people would become victims for every 20,000 messages sent. Police had examined three people who received the smishing messages, but the total number of victims and financial losses had not been established.
Approximately IDR50mn (USD2,800) was seized from accounts linked to the suspects.
SMS blasters impersonate legitimate mobile base stations and transmit messages directly to nearby phones, bypassing the normal SMS delivery systems where operators can apply filtering.
Bypassing those filters does not make a false base station impossible to detect. Dr Silke Holtmanns and Eleanor Holtmanns explain in How to Detect SMS Blasters how abnormal handovers and signalling when phones reconnect to legitimate networks can expose their presence.
Photographs of the equipment seized from the car are reproduced below.
The incident has been added to the SMS blaster map on the Commsrisk Global Fraud Dashboard. You can read the Indonesian National Police announcement here.
Photographs: Hanang Septioyudho/Tirto; Ali Mansur/Poskota
