Scams Posing as Internet Provider Technicians

Home internet providers hold valuable data: names, addresses, phone numbers, and often payment methods. No wonder their name is often borrowed by scammers. The patterns repeat, so they are easy to spot once you know the signs.

This guide covers the most common patterns, how to verify without relying on information from the scammer, and the steps to take if it has already happened.

The most common patterns

• A free speed upgrade. The caller announces a "speed upgrade programme" and asks for the code that just arrived on your phone to "activate" it. That code is actually an OTP to log in to your account, an e-wallet, or your WhatsApp account.
• A disconnection threat. A message says your bill is overdue and service will be cut today unless you pay into a personal account or through a particular link.
• Fake bills. A message carries "bill details" as a link to a page imitating the provider's look. The page asks for card details, an account number, or a mobile banking login.
• Links or APK files. A WhatsApp message carries a "bill" or a "fault checking app" ending in .apk. Installing it can give the attacker access to the SMS and notifications on your phone, including bank OTPs.
• Remote access apps. The scammer asks you to install an app such as AnyDesk or TeamViewer, or to share your screen on a video call, on the pretext of "fixing the modem from head office". Once connected, they can see everything you type.
• Star-and-hash codes. The scammer asks you to dial a code such as **21* followed by a number to "test the line". That code forwards all incoming calls to the scammer's number, including calls carrying verification codes.
• Fake customer service accounts. After you complain on social media, an account with a name similar to the provider's replies and invites you to continue on a personal WhatsApp. The same pattern happens with fake "customer service" numbers that show up in search results.
• A technician turning up unscheduled. The visitor claims to need to "replace the modem" or "check the network", then asks for a cash fee or wants to take equipment away.

What sets them apart from real staff

• Official staff never ask for OTP codes, PINs, or account passwords.
• Official payments are not made to accounts in a private person's name.
• Technician visits usually follow a fault report or an installation schedule recorded in the provider's app.
• Official apps are installed from the Play Store or App Store, not from files sent over chat.
• Home internet faults are not fixed by controlling your phone or laptop remotely.
• Time pressure, "today", "cut off in five minutes", is a warning sign, not a procedure.

A caller who knows your name, address, and customer number isn't necessarily genuine. Data like that can come from a data leak or from a document that was once photographed. Being able to recite your details is not proof of identity.

Situations, warning signs, and the right response

How to verify

The simplest rule: end the conversation, then call back through official channels. Find the customer service number on the provider's website or app, never the number the caller gives you.

1. Open the provider's official app installed from the app store. See whether there is a bill, fault ticket, or scheduled visit matching what the caller claims.
2. Type the provider's website address yourself, not via a link in a message. Watch for domain names that look similar but differ by one letter.
3. Call customer service on the number shown in that app or website, not one from search results or social media comments.
4. For social media accounts, open the provider's official profile from the link on its official website. An account that asks to move to a personal WhatsApp is suspect.

For a visitor at the door, ask for their name, staff ID card, and visit ticket number, then check it with customer service before letting them in. A genuine technician will understand the check.

If a technician really does need router access, stay with them and change the admin password afterwards. Why the admin password matters is covered in the guide to provider default router admin accounts, and other settings worth locking down are in the guide to securing a home router.

If it's already happened

Order matters. Start with whatever involves money:

1. Call your bank immediately on the number on the back of your card or in the bank's official app, if account details, card details, or a bank OTP were leaked, or if you installed an APK on a phone with banking apps. Ask for a temporary block. Other safe habits are covered in the guide to mobile banking security.
2. If you installed an APK, disconnect the phone from the internet, remove the app, and check Settings > Accessibility and the list of device admin apps for anything unfamiliar. If in doubt, back up important data and factory reset the phone.
3. If you dialled a call-forwarding code, dial ##002# to cancel all forwarding, then contact your mobile operator if unsure.
4. Secure WhatsApp and email. In WhatsApp, open Settings > Linked devices and log out any device you don't recognise, then turn on two-step verification. The guide is in the guide to two-step verification.
5. Contact the provider's official customer service and ask for the account to be secured.
6. Change the passwords for the provider account, the linked email, and the Wi-Fi password.
7. Keep evidence: screenshots of the conversation, the scammer's number, the destination account number, and transfer receipts.

Further steps for a router the attacker may have changed are in the guide to what to do after Wi-Fi is hacked.

Reporting

• The scammer's phone number can be reported through the government site aduannomor.id.
• The scammer's account number can be reported and checked at cekrekening.id. Also report it to the bank holding that account, through your own bank.
• Fraud with losses can be reported to the police, either at the nearest police station or through the National Police's patrolisiber.id. Bring the evidence you kept.
• Report it to the internet provider too through its official channels, so it can warn other customers.

If your personal data seems to have leaked from a service, the steps are covered in the guide to reporting a personal data leak.

Mistaken beliefs scammers exploit

• "They know my details, so they must be official staff." Customer data can leak or be bought.
• "The number uses the provider's logo, so it must be official." Anyone can set a profile picture and display name.
• "Giving away just one code is fine." A single OTP is often enough to take over an account.
• "Only older people get fooled." These patterns are designed to make anyone panic and rush. Sharing this guide with the family at home matters just as much.

Conclusion

Scams in an internet provider's name almost always ask for one of a few things: an OTP code, payment to a personal account, installing an app from chat or a remote access app, or dialling a code on your phone. Refuse them all, end the conversation, and verify through an official number you look up yourself. If it has already happened, call the bank first, then secure your accounts and report it.

Frequently asked questions