The Social Aid Trap: How AI Deepfakes of the President Defraud Indonesians

A video circulating on TikTok shows the President of Indonesia announcing a special, unpublicized Social Aid (Bansos) fund for working-class citizens. To claim the millions of Rupiah promised, viewers simply need to message a WhatsApp number and pay a small “administrative fee.” Thousands fell for it.

⚠️ THREAT INTELLIGENCE ADVISORY:
Throughout 2025 and 2026, cyber syndicates in Indonesia have aggressively deployed AI deepfakes featuring President Prabowo Subianto and former Finance Minister Sri Mulyani. These campaigns specifically target vulnerable demographics with fraudulent social assistance schemes.

While deepfakes in the West often target corporate executives, the Southeast Asian model frequently exploits economic desperation and public trust in government welfare.

Table of Contents

Context / Motivation

In Indonesia, scammers utilize a “high-volume, low-yield” strategy. Rather than stealing millions from one executive, they steal Rp 100,000 (around US$6) from thousands of individuals. By capitalizing on genuine government initiatives (like Bansos), the deepfakes create a highly believable pretext for working-class citizens seeking economic relief.

Technical Analysis: The Anatomy of a Deepfake Scam

The syndicates operating these scams prioritize viral distribution over perfect technical execution.

Impact Assessment

These scams have successfully drained tens of millions of Rupiah from victims across more than 20 provinces. Beyond the financial toll on vulnerable populations, it severely damages the credibility of genuine government communication and aid distribution channels.

Mitigation Recommendations

1. Verify Official Channels: Never trust social media videos announcing financial aid. Always verify government programs directly through official .go.id websites or verified social media accounts (with the blue tick).
2. Follow the Money: Government agencies will never ask citizens to transfer money to a personal e-wallet or obscure virtual account to receive social aid. Any request for an “upfront admin fee” is a definitive indicator of a scam.
3. Aggressive Takedowns: Social media platforms must improve their localized moderation algorithms to detect and remove deepfake content in regional languages (Bahasa Indonesia) more rapidly, as highlighted by digital literacy groups like Mafindo.

Mitigation & Prevention Strategies

Exploitation of vulnerabilities in critical infrastructure and edge devices requires immediate remediation to prevent catastrophic disruption:

• Patch Management: Apply vendor-supplied security patches or firmware updates immediately. For legacy systems, deploy virtual patching via network firewalls.
• Isolate OT Networks: SCADA and OT environments must be strictly isolated from corporate IT networks (the Purdue Model) to prevent spillover attacks.
• Continuous Monitoring: Deploy Endpoint Detection and Response (EDR) solutions and monitor network traffic for indicators of compromise (IoCs) associated with known exploits.

Strategic Defense Matrix and Incident Hardening

Operational intelligence analysis of this Threat Intelligence campaign indicates that the threat actors frequently exploit configuration oversights, unpatched external-facing gateways, and weak credential management policies across targeted organizations. Enterprise security operations centers (SOC) and defensive engineering teams must deploy layered perimeter safeguards to detect and neutralize similar threat vectors before lateral movement occurs.

• Continuous Asset and Perimeter Auditing: Maintain real-time inventory of all public-facing services, verifying SSL/TLS certificates and eliminating unauthenticated administrative interfaces following CISA Defensive Guidelines.
• Behavioral Anomaly and Zero-Trust Telemetry: Enforce strict hardware-backed multi-factor authentication (MFA) across all remote access nodes and implement endpoint detection and response (EDR) telemetry mapped to the MITRE ATT&CK Framework.
• Threat Intelligence Integration: Security teams are encouraged to correlate emerging indicators of compromise (IoCs) and evaluate network vulnerability profiles using our Cyber Risk Checker or submit anonymous confidential threat data via CyberAsia Secure Drop.