Avoiding ATM Scams in Indonesia: A Traveler’s Safety Checklist

Most travelers arriving in Bali or Jakarta in 2026 know to watch out for scams — but ATM fraud still catches people out every year, including experienced travelers who think they know the risks. The problem is not that Indonesia is unusually dangerous for your bank card. It is that tourist habits (rushing, trusting convenience ATMs near the beach, not checking withdrawal limits) create predictable opportunities for the small number of people who run these schemes. With Indonesia’s digital payment infrastructure now more capable than ever, you have more ways than before to protect yourself — but you still need cash, and that means ATMs. Here is exactly how to use them safely.

The Four ATM Scams Still Active in Indonesia in 2026

Understanding what you are protecting against makes the checklist below feel less like paranoia and more like common sense. These are the four methods that still show up in traveler reports and local police records.

• Skimming: A thin device is fitted over the card slot that reads your card’s magnetic stripe as it enters. A hidden camera or a false keypad overlay simultaneously captures your PIN. The scammer retrieves the device later and clones your card. You feel nothing during the transaction — your money comes out normally — but within hours or days, withdrawals begin elsewhere.
• Card trapping: A device inside the ATM physically holds your card so it does not eject. A stranger appears and offers to help, asks you to re-enter your PIN (which they watch), then tells you to visit the branch to sort it out. The moment you leave, they retrieve your card and drain your account.
• Shoulder surfing: The low-tech version. Someone stands close enough to watch your fingers on the keypad, then follows you or pickpockets you for your card later. This happens in busy areas — airport ATM queues, the ATM lobbies near Kuta’s main strip, crowded malls.
• Fake ATMs: Rare, but documented in very remote areas. The machine looks real, accepts your card, records your details, then returns a “system error.” It exists only to steal data. If you have never seen an ATM in that location before, treat it with suspicion.

How to Choose a Safe ATM in Indonesia

Location is your first and most powerful filter. Not all ATMs carry equal risk.

Always prefer:

• ATMs inside a bank branch during opening hours — Bank Mandiri, BCA, BRI, and BNI all have networks across Java, Bali, Lombok, and Sumatra. These machines are checked regularly by staff and are monitored by CCTV that the bank actually reviews.



• ATMs inside major shopping malls such as Grand Indonesia, Mal Bali Galeria, or Lippo Mall. Mall security makes it difficult to tamper with machines without being seen.
• ATMs in airport arrivals halls and hotel lobbies. Soekarno-Hatta (CGK) and Ngurah Rai (DPS) both have multiple reputable bank ATMs airside and in the arrival zone.

Avoid or treat with extra caution:

• Standalone ATM booths on busy tourist streets — the ones near Kuta Beach, Legian, or Seminyak’s gang lanes are a known target for skimmer installations.
• ATMs in poorly lit areas at night.
• Any ATM where the booth door has been propped open or the locking mechanism feels broken — this reduces the physical security that normally deters tampering.

Your Physical Inspection Checklist Before Every Withdrawal

This takes about fifteen seconds. Do it every single time, even at machines you have used before — skimming devices can be installed and removed within a day.

1. Card slot: Grip the card reader and try to wiggle it. A genuine card slot is fixed firmly. A skimmer overlay often has slight play in it or feels slightly sticky. If it moves even a few millimetres, walk away.
2. Keypad: Press a few keys before you start. A real keypad feels solid and clicks cleanly. A false overlay sits slightly higher than it should and feels spongy or wobbly underneath your fingers.
3. Camera positions: Look above and to the sides of the screen for anything that looks like a small hole, a tiny lens, or a piece of hardware that does not obviously belong to the machine’s design. Legitimate ATMs have one visible security camera — usually mounted high and pointing at your face, not your hands.
4. Unusual mirrors: A small convex mirror placed at an odd angle near the keypad is sometimes used to reflect your PIN to a camera. If you see one, leave.
5. Your surroundings: Before you insert your card, look behind you. If someone is standing closer than they need to be, reposition yourself or wait until they move. The smoky busy atmosphere of a street-level ATM on Jalan Legian at night, with mopeds squeezing past and music thumping from nearby bars, is exactly the kind of environment where shoulder surfing feels invisible to the person doing it.

If anything fails this checklist, report it. Call the bank’s number displayed on the machine or tell the nearest branch staff. Then use a different ATM.

ATM Fees, Withdrawal Limits, and the DCC Trap

Understanding the cost structure stops you from making multiple small withdrawals (which multiplies your risk exposure and your fees) or accepting bad exchange rates.

Withdrawal limits per transaction at most Indonesian bank ATMs in 2026:

• IDR 1,500,000 per transaction if the machine dispenses IDR 100,000 notes
• IDR 2,500,000 per transaction if the machine dispenses IDR 50,000 notes
• Daily total limit: IDR 10,000,000 to IDR 15,000,000 depending on the Indonesian bank’s ATM and your home bank’s own daily cap

Fees to expect:

• Indonesian bank ATM fee to you: typically IDR 10,000 to IDR 25,000 per transaction, though some banks still charge nothing to international cardholders. This varies by bank and can change — check the screen before confirming.
• Your home bank’s fee: usually a fixed international withdrawal fee (equivalent to roughly IDR 80,000–160,000 at 2026 rates, based on a USD 5–10 fee) plus a foreign transaction fee of 1–3% of the withdrawal amount.

Dynamic Currency Conversion (DCC) — always decline this. If the ATM screen asks whether you want to complete the transaction in your home currency (USD, AUD, EUR, GBP), select “No” or “Continue in IDR” every time. DCC converts the amount using an exchange rate set by the ATM operator, not the interbank rate. The markup is typically 3–8% above what your bank would charge. It feels convenient. It costs you real money. The same rule applies when paying by card at shops, restaurants, and hotels — always choose IDR.

Before You Land — Cards, Bank Settings, and Emergency Prep

The steps you take before arriving in Indonesia are just as important as what you do at the machine.

• Notify your home bank of your travel dates and destinations. If your bank sees an ATM withdrawal in Ubud when your last transaction was in London two days ago, they may freeze your card as a precaution. A two-minute phone call or in-app notification before you fly prevents this.
• Check your card’s daily international withdrawal limit. Many banks default to a lower limit for international transactions as a fraud control measure. You may need to increase it manually through your app or by calling the bank.



• Use a travel-friendly card. Cards that refund foreign ATM fees and charge no foreign transaction fee (such as Wise, Revolut, or similar global fintech debit cards available in most countries) significantly reduce your costs and often provide better fraud protection and instant card-freeze features through their apps.
• Carry your bank’s international fraud hotline number separately from your card. Save it in your phone and write it in a note in your bag. If your card is cloned or trapped, you need this number fast — and you will not have time to search for it online if your phone battery is dying at midnight in Seminyak.
• Set up transaction alerts. Most banks and all fintech cards allow you to receive an instant notification for every card transaction. This is your fastest early-warning system. The moment something looks wrong, you can freeze the card remotely.

What to Do If Your Card Is Trapped or Cloned

Acting quickly limits the damage. Here is the sequence:

1. If your card is trapped: Do not leave the machine. Call the bank number on the ATM screen immediately and explain what happened. Do not enter your PIN again for anyone. If you cannot reach the bank and must leave, freeze your card remotely through your banking app before you walk away.
2. If you suspect skimming (unauthorized transactions appear): Freeze your card instantly through your bank’s app or by calling the international fraud hotline. File a report with your bank’s fraud department. In Indonesia, you can also file a report with the local police (Polisi) — your bank may require this for reimbursement. The nearest Polsek (local police station) can issue a report letter (Surat Keterangan Laporan).
3. Contact Bank Indonesia’s consumer protection line if the ATM belongs to an Indonesian bank and you believe the machine itself was compromised: the number is listed at bi.go.id. This puts the local bank on notice and may help with your reimbursement case.
4. Check your account every 24 hours for the rest of your trip. Skimmed card data is sometimes sold and used weeks later, not immediately.

When to Skip the ATM Entirely — Safer Alternatives in 2026

Indonesia in 2026 gives you genuinely good alternatives to cash in many situations, which means you can reduce how often you need an ATM at all.

QRIS: Bank Indonesia’s universal QR code payment system is now accepted at an enormous range of merchants — restaurants, warungs, convenience stores, transport hubs, and markets across Java and Bali. If you have a bank account or e-wallet that supports QRIS, you can pay without touching cash. For travelers from Malaysia, Singapore, and Thailand, cross-border QRIS interoperability has been expanded in 2026, meaning you may be able to scan QRIS codes directly from your home country’s banking app. Check with your bank before traveling.

Gojek and Grab via international card: Both apps accept Visa and Mastercard directly linked to your account — no Indonesian bank account needed. For ride-hailing, food delivery, and GoFood orders, this keeps your cash in your pocket and your ATM visits to a minimum.

Hotel and restaurant card payments: Most mid-range and all upscale hotels accept Visa and Mastercard. Always choose to pay in IDR to avoid DCC.

Cash remains essential for traditional markets, small warungs, becak drivers, and anywhere you travel off the main tourist circuit. But in Bali, Lombok’s Gili Islands, and across Jakarta, the number of situations where you absolutely need cash is shrinking year by year.

2026 Budget Reality — Cash Costs and What to Expect

Here is a practical breakdown of cash-related costs for travelers in 2026, so you can plan how much to withdraw and how often.

• Budget traveler (hostels, warungs, local transport): Plan to spend IDR 200,000–400,000 per day in cash for food, transport, and small purchases. Withdraw IDR 1,000,000–2,000,000 every few days.
• Mid-range traveler (guesthouses, mix of local and tourist restaurants, day trips): IDR 500,000–900,000 per day. A mix of card, QRIS, and cash works well.
• Comfortable traveler (boutique hotels, guided tours, quality restaurants): IDR 1,000,000–2,500,000+ per day. Cards handle most large expenses; cash needed for tips, markets, and transport.

Tipping in cash: IDR 10,000–20,000 for restaurant staff where no service charge is included, IDR 50,000–100,000 per day for private drivers, IDR 50,000–150,000 per person per day for tour guides. Hotel bellhops and housekeepers: IDR 10,000–20,000 is appropriate.

When exchanging foreign currency, use licensed money changers only — not the ones that shout rates at you from the street. Count every note before you step away from the counter. Authorized money changers in central Bali tourist areas offer competitive rates for USD, EUR, AUD, GBP, and JPY.

Frequently Asked Questions

Which Indonesian banks have the safest ATMs for tourists?

Bank Mandiri, BCA, BRI, and BNI are the four major banks with the most widely monitored ATM networks. Machines inside their branches or in major malls are your safest bet. All four have strong presences in Bali, Java, and Lombok. Visit their official sites — bankmandiri.co.id, bca.co.id, bri.co.id, bni.co.id — to locate branches near your accommodation.

What is the maximum I can withdraw from an ATM in Indonesia per day?

Most Indonesian bank ATMs allow between IDR 10,000,000 and IDR 15,000,000 per day in total, with individual transactions capped at IDR 1,500,000 to IDR 2,500,000 depending on the machine. Your home bank may impose a lower international daily limit — check and adjust this before you travel.

Should I always decline Dynamic Currency Conversion at Indonesian ATMs?

Yes, always. Select “Continue in IDR” whenever an ATM or card terminal offers to charge you in your home currency. DCC rates are set by the machine operator and carry a 3–8% markup over the interbank rate — paying in IDR is always cheaper.

Can I use Google Pay or Apple Pay in Indonesia in 2026?

Acceptance remains limited compared to Europe or Australia. Some larger retailers and international chain hotels accept contactless payments, but coverage is inconsistent. For reliable cashless payment, linking your Visa or Mastercard directly to Gojek or Grab, or using QRIS where cross-border support applies, is more practical for most tourists in 2026.

What should I do if my card is skimmed or cloned in Indonesia?

Freeze your card immediately through your bank’s app or by calling the international fraud hotline. File a report with your bank’s fraud team and, if required for reimbursement, obtain a Surat Keterangan Laporan from the nearest Polsek. Monitor your account daily for the remainder of your trip and for several weeks after returning home.

📷 Featured image by ivan hermawan on Unsplash.