Istimewa
BI-FAST is facing a dilemma. Cyberattacks are no longer aimed only at banks. Securities firms and f inance companies have also become targets of so called digital tuyul or digital thieves. As the backbone of Indonesia’s national payment system, BI-FAST itself is now under threat.
Fast payment systems like BI-FAST have delivered undeniable benefits. Real-time, 24/7 transactions have become the lifeblood of business activity and consumer spending. This progress deserves recognition.
Yet behind the success narrative lies a growing vulnerability. Fragility in cybersecurity has emerged at the very core of systemic payment infrastructure, and it can no longer be ignored.
As operator of BI-FAST, Bank Indonesia controls the country’s most vital payment rails. At the same time, it serves as regulator. This dual role creates a structural paradox.
When breaches occur, accountability becomes blurred. How does an institution objectively assess the security of a system it operates itself? This unresolved question sits at the heart of today’s risks.
Data from the Infobank Research Bureau, based on incidents throughout 2024 and 2025, paint a troubling picture. Estimated losses from fraudulent transactions routed through systemic infrastructure, including BI FAST, RTGS, and GPN Switching, have reached IDR 3 to 5 trillion.
Fraud has expanded beyond conventional and Islamic banks. It now reaches into non-bank financial institutions, including customer fund accounts at securities firms and f inance companies. Attacks are increasingly cross industry and target third-party system enablers.
More concerning is the sophistication of these schemes. Fraudulent transactions are deliberately routed through national systemic infrastructure, particularly BI FAST. This is no longer ordinary fraud.
It points to structured attacks that exploit the legitimacy and speed of trusted systems. There are also indications of collaboration between domestic and international actors who understand technical and procedural weaknesses.
These developments expose vulnerabilities in the BI FAST Fraud Detection System. While Bank Indonesia has strengthened security requirements and ICT standards, responses often appear reactive rather than preventive.
The challenge ahead will intensify. Cyberattacks powered by artificial intelligence will become more targeted, harder to trace, and more damaging. Bank Indonesia will never be fully immune.
Acknowledging vulnerability is the first and most necessary step. According to the Infobank Institute, three priorities must follow. First, Bank Indonesia must clearly separate its roles as regulator and operator. As regulator, it must impose the highest security standards and firm sanctions. As operator, BI-FAST must be independently tested, audited, and reviewed by credible third parties, with transparent disclosure.
Second, governance must be strengthened. A permanent joint forum involving Bank Indonesia, OJK, LPS, law enforcement, and the banking industry is needed, with a single focus on cybercrime resilience and real-time threat intelligence sharing.
Third, investment in human capital is essential. Advanced technology is ineffective without skilled professionals. Continuous training, red-team simulations, and recruitment of top cyber talent must become priorities. A strong cybersecurity culture must reach from boardrooms to front-line staff.
BI-FAST is a national achievement. It is also a responsibility and a point of vulnerability. Indonesia’s digital economic sovereignty now depends on its security.
As 2026 approaches, cyber heists are expected to rise. Vigilance alone is no longer enough. Action, investment, and awareness are required before the next trillions of rupiah in losses once again emerge from the heart of the national payment system, while responsibility continues to be shifted elsewhere.
Fast payment systems like BI-FAST have delivered undeniable benefits. Real-time, 24/7 transactions have become the lifeblood of business activity and consumer spending. This progress deserves recognition.
