Sachin V Gopalan, Founder & CEO, Indonesia Economic Forum
The digital revolution promised to democratize opportunity. Unfortunately, the criminals got the memo too.
In Hong Kong, an employee of international engineering firm Arup joined what appeared to be a perfectly ordinary video conference with the company’s chief financial officer and several colleagues. Everyone looked familiar. Everyone sounded familiar. The discussion seemed legitimate. There was just one small problem: the colleagues were digital impersonations. Criminals had used deepfake technology to stage the meeting, persuading the employee to transfer approximately US$25 million into fraudulent accounts. The company had not merely been hacked. Its management had effectively been recreated.
In the United States, another extraordinary business model emerged. North Korean operatives used stolen identities to secure legitimate, well-paid remote technology jobs at American companies. Their employer-issued laptops were housed in American homes, allowing the workers to appear to be operating locally while secretly connecting from overseas. The companies received what appeared to be legitimate IT services, while the salaries helped generate illicit revenue for North Korea. Apparently, even international sanctions can be challenged by a convincing résumé, a remote connection and a good HR interview.
And in Italy, some of the country’s wealthiest business leaders received urgent telephone calls apparently from their own defense minister. The callers, in some instances reportedly using AI-generated voice impersonation, claimed that money was needed to rescue kidnapped Italian journalists. One businessman reportedly transferred €1 million. The real defense minister, Guido Crosetto, had to publicly warn people that he was not conducting a government ransom collection drive.
Welcome to the Digital e-CON-omy.
We have spent decades celebrating the digital economy for its extraordinary ability to democratize commerce, eliminate intermediaries, reduce transaction costs and connect billions of people. Unfortunately, the criminals have been attending the same technology conferences, reading the same innovation playbooks and apparently paying rather more attention.
They have embraced artificial intelligence, perfected remote working, mastered cross-border payments, automated customer acquisition and developed remarkably scalable business models. They have even eliminated the inconvenience of meeting their victims.
The digital revolution promised to make everyone an entrepreneur. It seems to have delivered on that promise rather more literally than we intended.
The World’s Fastest-Growing Underground Industry?
The numbers are staggering. According to the Global Anti-Scam Alliance’s 2025 research, consumers across 42 surveyed countries suffered an estimated US$442 billion in scam losses over the preceding 12 months. In the United States alone, the FBI recorded nearly US$21 billion in reported cyber-enabled crime losses in 2025. And closer to home, the United Nations Office on Drugs and Crime has estimated that organized cyber-enabled fraud networks in Southeast Asia generate between US$27 billion and US$36 billion annually.
These figures measure different aspects of the problem and should not be added together. But they tell a consistent story: digital deception has become an industrial-scale economic activity.
Article Illustration
Consider the business model. Traditional criminals needed physical access, local knowledge and considerable personal risk. Today’s digital operators can reach millions of potential victims across continents, conduct thousands of simultaneous conversations, impersonate trusted institutions and move proceeds across borders in minutes. Some operations even resemble legitimate corporations, complete with recruitment departments, performance targets, technology teams and customer relationship management systems. The customer, of course, is usually unaware that the relationship is being managed toward bankruptcy.
Southeast Asia has become an important center of this underground industry. Criminal networks operating scam compounds in parts of Myanmar, Cambodia and Laos have combined online fraud with human trafficking, forced labor and sophisticated money laundering. In some cases, the people conducting scams are themselves victims, coerced into criminal activity under threats of violence.
This is no longer simply a matter of clever individuals tricking gullible people. It is organized crime exploiting the infrastructure of globalization.
Indonesia has its own version of the e-CON-omy. The Financial Transaction Reports and Analysis Center, PPATK, reported online gambling transaction turnover of approximately Rp286.8 trillion in 2025, down from Rp359.8 trillion in 2024. While the decline suggests enforcement efforts may be having an effect, the remaining volume is extraordinary. Meanwhile, Indonesia’s Anti-Scam Centre recorded reported fraud losses of approximately Rp9 trillion by December 23, 2025, demonstrating that the threat extends well beyond illegal gambling.
It is important to distinguish gambling turnover from criminal profits or direct consumer losses. Nevertheless, the scale reveals how deeply these activities have penetrated the digital financial ecosystem.
The e-CON-omy has developed its own formula for extraordinary growth, built around four powerful capabilities: Anonymity, Automation, Amplification and Artificial Intelligence. Call them the Four A’s of the Digital e-CON-omy.
Anonymity allows criminals to conceal their identities, impersonate trusted institutions and operate across borders with little fear of immediate identification. Automation enables fraudsters to reach thousands of victims simultaneously through bots, scripts and industrial-scale scam operations. Amplification exploits social media algorithms, targeted advertising and digital networks to spread deception at extraordinary speed, sometimes using the very platforms designed to connect and inform us. And Artificial Intelligence has taken the business to another level, making deepfake identities, cloned voices, fabricated evidence and personalized deception cheaper, faster and frighteningly convincing.
None of these capabilities is inherently criminal. Indeed, they are among the foundations of modern digital innovation. But when exploited by criminals, they become powerful multipliers of deception, scale and financial damage.
Perhaps the most uncomfortable question is whether parts of the legitimate digital economy are inadvertently benefiting from the criminal one. Fraudulent advertising generates impressions and clicks. Illegal gambling creates payment traffic. Scam operations consume telecommunications services, cloud infrastructure and digital tools. This does not make their providers complicit, but it raises a serious question about the responsibility of platforms and intermediaries to identify and disrupt abuse.
Bali Tech Week: The Good Guys Strike Back
Against this backdrop, Bali Tech Week 2026, held from October 19–23, offers a timely window into how Southeast Asian governments are confronting the darker side of digital transformation.
At the opening, Indonesia’s Minister of Communication and Digital Affairs, Meutya Hafid, emphasized three priorities for the country’s digital future: connectivity, growth and protection. Under the government’s Terhubung, Tumbuh, Terjaga framework, digital infrastructure must not merely connect citizens and create economic opportunities. It must also protect them.
That third pillar may prove to be the most consequential.
Indonesia has made remarkable progress in digital connectivity, with approximately 235 million internet users in 2026. But every newly connected citizen is also a potential target for fraud, identity theft, malicious content and financial exploitation. Digital inclusion without digital protection risks expanding the addressable market for criminals alongside legitimate businesses.
Singapore’s Minister for Digital Development and Information, Josephine Teo, similarly emphasized the importance of trust in sustaining digital growth. Her warnings at Singapore International Cyber Week, just days before the Bali gathering, were particularly revealing. She described how scammers had used deepfake technology to impersonate Prime Minister Lawrence Wong and other officials in a virtual meeting, illustrating how even the highest offices of government can be digitally counterfeited.
Singapore has responded by deploying AI-powered systems capable of screening more than 600,000 websites daily and disrupting approximately 20,000 malicious websites each month. Its police have also worked with Meta to act against millions of scam-linked accounts and entities. In an interesting reversal, the same artificial intelligence that helps criminals manufacture deception is now being deployed to detect it.
Malaysia’s Communications Minister, Fahmi Fadzil, brought another dimension to the regional discussion. Speaking in Bali, he highlighted the exploitation of minors through social media, online sexual predators and the misuse of gaming platforms to recruit young people into violence. His concerns demonstrate that the e-CON-omy cannot be measured solely in stolen money. Its costs include damaged lives, compromised childhoods and the erosion of public confidence in digital spaces.
Indonesia’s Vice Minister Angga Raka Prabowo’s Bali Tech Week discussions on open APIs, telecommunications reform and regulatory sandboxes illustrate the parallel challenge: enabling innovation while preventing the same infrastructure from being exploited. Meanwhile, Vice Minister Nezar Patria has warned about AI-enabled deepfakes and increasingly sophisticated social engineering, advocating security by design rather than treating protection as an afterthought.
Komdigi’s Secretary General, Dr. Ismail, reinforced this message at Bali Tech Week, emphasizing that digital governance must keep pace with technological progress, particularly in protecting personal data, securing electronic systems and combating misinformation and cybercrime. He cautioned that regulation must protect citizens without stifling innovation or economic growth. Equally important, he called for stronger ASEAN cooperation through the Digital Economy Framework Agreement (DEFA), arguing that regional agreements must translate into practical action built on mutual trust. For an e-CON-omy that operates effortlessly across national borders, this may be one of the most important countermeasures.
Director General of Digital Ecosystem Edwin Hidayat Abdullah emphasized collaboration among government, industry, startups, investors and universities. That cooperation is equally essential for cybersecurity. Criminal networks do not respect organizational boundaries, and fragmented defenses provide them with opportunities.
That ambition is also taking shape through Garuda Spark, the national innovation hub initiative championed by Dr. Sonny Hendra Sudaryana, Director of Digital Ecosystem Development at Komdigi. Anchored in the government’s Terhubung, Tumbuh, Terjaga philosophy, the program has expanded to 10 innovation hubs and 60 spokes, reaching more than 15,700 digital talents and supporting 80 startups. Dr. Sonny has emphasized that building a sustainable digital ecosystem must go hand in hand with developing talent and ensuring technology delivers lasting benefits to society. The relevance to fighting the e-CON-omy is clear: Indonesia needs not only more digital entrepreneurs, but a generation of innovators equipped to build safer, more trustworthy digital services.
The private sector has an equally important role to play. Telkomsel President Director Nugroho told Bali Tech Week that telecommunications companies must move beyond connectivity into artificial intelligence, digital security and services that create tangible value for society. He also argued that Indonesia must develop its own technological capabilities rather than remain merely a consumer of global innovation. But there is another responsibility that comes with connecting millions of citizens: protecting them. Telecommunications networks are not just highways for legitimate digital commerce; they can also become delivery channels for scams, impersonation and financial fraud. The industry’s next competitive advantage may therefore lie not only in faster networks and smarter AI, but in making those networks demonstrably safer for everyone.
The cybersecurity industry is already confronting the consequences. Patrick Dannacher, President Director of ITSEC Asia, which is hosting the AI & Cybersecurity Executive Forum (AICX) during Bali Tech Week, warned that cybercriminals are now using AI agents to automate phishing and ransomware attacks against thousands of targets simultaneously. His warning was particularly stark: “Bank robbers once arrived with weapons and broke into vaults. Today, those crimes have evolved into digital attacks. If we do not use AI on the defensive side, attackers will have an absolute advantage.” The message is unmistakable. Fighting the digital e-CON-omy with yesterday’s cybersecurity tools is rather like sending a security guard armed with a whistle to stop a bank robbery conducted by robots. Governments and businesses must match the criminals’ technological sophistication, not merely admire it from a distance.
Taken together, these statements point toward an important shift in the regional digital agenda. Governments are beginning to recognize that the success of the digital economy cannot be measured only by internet penetration, unicorn valuations, transaction volumes or the number of applications downloaded.
It must also be measured by whether citizens can participate safely.
From Digital Literacy to Digital Survival
What, then, should Indonesia and its ASEAN neighbors do?
The answer begins with four good words to counter the four troublesome ones: Trust, Security, Regulation and Awareness.
Trust cannot simply be demanded through government announcements or corporate advertising. It must be earned through systems that verify identities, authenticate transactions, protect personal information and provide effective remedies when things go wrong. Banks, telecommunications operators, technology platforms, payment providers and government agencies must be able to exchange fraud intelligence quickly, within appropriate legal and privacy safeguards.
Security must become a fundamental design principle rather than an optional feature. AI-powered fraud detection, stronger authentication, verified communications and rapid freezing of suspicious transactions can dramatically reduce the window in which criminals operate. Singapore’s experience offers useful lessons, while Indonesia’s Anti-Scam Centre provides an institutional foundation that can be strengthened and expanded.
Regulation must also evolve. Criminal enterprises operate across jurisdictions, currencies, platforms and identities, while enforcement agencies remain largely organized within national boundaries. ASEAN needs stronger cooperation on cybercrime intelligence, cross-border investigations, asset recovery and the disruption of organized scam networks. Regulations should be sufficiently flexible to support innovation but sufficiently firm to hold irresponsible operators accountable.
Awareness is the fourth and perhaps most personal line of defense. Digital literacy can no longer mean simply knowing how to use a smartphone, download an application or make an online payment. It must include the ability to question digital identities, recognize manipulation, detect suspicious financial requests and understand that even familiar faces and voices can be fabricated. Governments, schools, employers, banks and technology companies must make digital safety education as universal as digital access itself. After all, the most sophisticated cybersecurity system can still be defeated by one convincing telephone call.
There is also a lesson for ordinary readers. A familiar face on a video call is no longer proof of identity. A convincing voice may not belong to the person speaking. A professional website does not guarantee a legitimate business. A celebrity endorsement may be entirely fabricated. And a message apparently from your bank, employer or government may be the beginning of a carefully scripted deception.
The simplest defense remains surprisingly old-fashioned: verify independently, question unusual requests, avoid rushed financial decisions and never confuse technological sophistication with trustworthiness.
The digital economy was supposed to make life easier, faster and more prosperous. It still can. But the next chapter must be about making it safer as well.
For policymakers, the challenge is to ensure that the growth of the digital economy does not inadvertently subsidize the growth of the digital e-CON-omy. For technology companies, it is to recognize that protecting users is not merely a compliance obligation but an essential condition for sustainable growth. And for citizens, digital literacy must now include the ability to recognize digital deception.
As for aspiring cybercriminals contemplating their next innovative startup, the message from Bali Tech Week should be encouraging in one respect: governments are finally taking their industry seriously.
Unfortunately for them, they are not being offered tax incentives, startup grants or unicorn valuations.
They are going to be offered something rather less attractive.
Free accommodation, courtesy of the criminal justice system.
