A Bean-Flour Dumpling Vendor Takes a Hundred Rp50,000 Payments at Night: Indonesia’s Central Bank Sets Out Four Measures to Block QRIS Gambling Payments

File photo: Bank Indonesia building on Jalan M.H. Thamrin in Jakarta, photographed 28 June 2026. Institutional context for the central bank’s QRIS measures; not a photograph of the October press briefing or the Boxkia investigation. Photo: Medelam / Wikimedia Commons, CC BY-SA 4.0. Display cropped to fit where necessary; no AI-generated imagery. Image source.

A stall sells cilok (Indonesian street-food bean-flour dumplings) during the day. After it closes for the night, its QR code keeps receiving payments: Rp50,000 each, a hundred times in one night. Bank Indonesia Deputy Governor Filianingsih Hendarta used this example at a press conference following the board of governors’ meeting in Jakarta on October 21 to explain what makes a QRIS transaction “suspicious.”

“The central bank takes the misuse of QRIS for illegal transactions very seriously,” she said. QRIS is the national unified payment QR-code standard introduced by Bank Indonesia. According to the central bank, it had 69.32 million users and 47.11 million merchants as of August 2026, the vast majority of the latter being micro, small and medium-sized enterprises.

Four Measures

According to Filianingsih, the central bank will tighten the QRIS ecosystem in four areas:

Merchant onboarding: payment service providers (PJP) and merchant aggregators must implement know-your-customer (KYC) checks when onboarding merchants, verifying their business scope, legitimacy and transaction characteristics. They must also conduct ongoing customer due diligence (CDD), “not just at the beginning”;

Detection of unusual transactions: transaction patterns inconsistent with a merchant’s business characteristics will be treated as suspicious indicators, and a “merchant blacklist” will be used to identify merchants suspected of misuse;

Institutional accountability: payment service providers and aggregators will be supervised regularly. Where a payment service provider is proven to have participated in illegal transactions, the central bank may restrict or suspend its operations, up to and including revoking its licence;

Inter-agency coordination: the central bank will work with relevant regulators, ministries and law-enforcement bodies to address illegal activities using QRIS.

Figures from the Financial Services Authority (OJK) cited on the same occasion showed that approximately 38,796 bank accounts had been flagged as gambling-related. Based on data supplied by the Ministry of Communication and Digital Affairs (Komdigi), OJK has instructed banks to conduct enhanced due diligence on, or freeze, these accounts. It has also called for accounts matching the national identification numbers (NIK) of people involved in gambling to be closed.

The Same Day: Payment Routes for a “Gacha” Website

On the day of the central bank’s remarks, the Indonesian National Police Criminal Investigation Agency’s Cybercrime Directorate (Dittipidsiber Bareskrim) announced the Boxkia.com case, in which QRIS was one of the deposit channels.

Cybercrime Director Brigadier General Suhermanto said investigators discovered the website during online patrols in September. It operated in a format resembling gacha or spinning-wheel games: players used virtual coins to draw prizes, which consisted of items, figurines or cards that could then be resold for cash. Deposit channels included BRIVA virtual accounts, the USDT crypto asset and QRIS. Withdrawals were suspected to have been made through Bank Permata and BRI bank accounts, using the DOKU payment service.

Police arrested four suspects in the Kembangan area of West Jakarta, with the following respective roles:

Jhiazi Chen (JC), a Chinese man: suspected of being the office’s effective controller and head of operations, responsible for assigning work and online promotion. Seven BCA bank cards, seven Chinese bank cards and four mobile phones were seized from him;

Farhan Akbar Djafar (FAD): the creative department, responsible for editing, design and posting promotional materials on Instagram and TikTok;

Alfi Sena Pradipta (ASP): customer service and administration, responsible for increasing user engagement to improve the website’s ranking;

Lesica (L): finance, responsible for bookkeeping, paying salaries and processing player deposits and withdrawals.

According to Kompas, Farhan was arrested in Kembangan at around 10 p.m. on October 20, while Jhiazi and Alfi were arrested at an apartment in the same area at around 12:30 a.m. on October 21.

The suspects are alleged to have violated Article 27(2) of Law No. 1 of 2024, the second amendment to the Electronic Information and Transactions Law, or Article 426 in conjunction with Article 20, and Article 607(1)(a), (b) and (c), of Law No. 1 of 2023, the new Criminal Code, concerning online gambling and money laundering. Suhermanto said investigators were still questioning suspects and witnesses, conducting digital forensic examinations and applying to freeze accounts linked to the operation. “Combating online gambling is one of the National Police Chief’s priorities,” he said. “We will continue to trace the operating systems, transaction tools and flow of funds.”

Points Still to Be Verified

The suspects’ nationalities: the police announcement and most reports, including those by Kompas, Antara and Detik, described “one Chinese national and three Indonesian nationals.” A few websites reported “four Chinese nationals,” which conflicts with the announcement. This article follows the former account.

The central bank’s four measures have so far appeared in remarks at the press conference; no corresponding written regulation or circular has yet been seen. The central bank did not explain exactly how the blacklist would operate or whether it would be linked to the account lists maintained by OJK and Komdigi.

The police announcement did not disclose Boxkia’s transaction volume or player numbers, nor did it state whether the payment service providers involved were being held accountable.

Sources

Antara News Agency: central bank sets out four strategies to tackle QRIS misuse for online gambling (2026-10-21): https://www.antaranews.com/berita/5802813/bi-serius-tangani-penyalahgunaan-qris-untuk-judol-dengan-4-strategi

Pikiran Rakyat: Deputy Governor Filianingsih’s remarks at the press conference (2026-10-21): https://www.pikiran-rakyat.com/ekonomi/pr-0110515297/bi-ungkap-ciri-qris-mencurigakan-jualan-cilok-transaksi-rp50-ribu-100-kali-pada-malam-hari

Antara News Agency: Criminal Investigation Agency uncovers the Boxkia online gambling case (2026-10-21): https://www.antaranews.com/berita/5802853/bareskrim-bongkar-kasus-judol-situs-boxkia-empat-orang-ditangkap

Detik: full quotations from Cybercrime Director Suhermanto’s written announcement (2026-10-21): https://news.detik.com/berita/d-8718099/bareskrim-bongkar-situs-judi-online-boxkia-tangkap-4-orang-termasuk-wn-china

Kompas: arrest times and locations (2026-10-21): https://nasional.kompas.com/read/2026/10/21/21124501/bareskrim-tangkap-4-orang-terkait-situs-judi-online-boxkia