The app is polished. It has a logo. Customer service replies quickly. The Telegram group is active. Everything feels normal, until your withdrawal is rejected with the excuse that the system is "under maintenance."
That is no coincidence. Creating a trading app that looks convincing is cheap. Real-time price charts are also inexpensive, as the data can be pulled for free from public data providers. There is only one thing that is expensive and cannot be faked: a license. That is why illegal platforms do not compete there. They compete on design, bonuses, and influencers—areas they have already won before you even start evaluating them.
So, stop judging by appearances. Follow these three steps, all of which you can do right now while reading this article.
Key Takeaways
- 228 illegal crypto platforms were shut down by the OJK and the PASTI Task Force between January and May 2026, and almost all of the victims felt that the platforms they were using looked normal.
- App appearance is not a measure of legality. Design, price charts, and responsive customer service are all cheap to create. Only a license cannot be faked.
- Three steps to check: open the official OJK list, match the company name, and then ask about their custodian. All three must pass, not just two out of three.
- Match the legal entity name, not the app name. The OJK list uses company names, and the app name is the easiest part to copy.
- The question about the custodian is the most effective filter because there is only one licensed crypto asset custodian in Indonesia, so a legal platform will be able to name it without hesitation.
- Five red flags that should make you stop immediately, ranging from promises of fixed returns to requests for OTP or 2FA codes.
- If you have already been caught, do not deposit any more money. Requests for additional deposits to "unlock" withdrawals are a common scam tactic, not a standard procedure.
Why Appearance Is Not a Measure
There is a simple economic logic that explains why illegal platforms always look good.
Building a convincing app interface today is relatively inexpensive. Trading app templates are widely available. Real-time price data can be pulled for free from public APIs like CoinGecko. Even customer support can be handled by a small team or a bot. Every element you use to judge whether something "looks professional" is actually the easiest thing to fake.
Licensing works the other way around. To get on the official OJK list, a company must go through a licensing process, meet capital requirements, submit to periodic supervision, and hold user assets in a separate custodian. There are no shortcuts, and there is no way to fake it, because the list is published directly by the regulator and is publicly accessible.
The bottom line: shift your assessment from things that are cheap to fake to things that cannot be faked at all.
Three Steps to Verify
Step 1: Check the official OJK list, not the platform's "About Us" page
Since the supervision of crypto assets moved to the OJK, the list of licensed operators has been published and updated directly on the OJK website. In December 2025, the OJK also issued an official whitelist via press release SP 226/GKPB/OJK/XII/2025, which contains the names of entities as well as the names of the licensed applications or platforms.
The current list can be accessed on the OJK's digital financial asset licensing page at ojk.go.id, under the Main Functions, ITSK, Digital Financial Assets and Crypto Assets section.
Common mistakes in this step. Many people check legality by opening the "About Us" or "Legality" page on the platform's own website, seeing an OJK logo there, and feeling satisfied. Anyone can paste a logo. Anyone can write the claim "registered and supervised by the OJK." The verification process must be reversed: start from the regulator's website, then search for the platform's name there, not the other way around.
A warning that also applies to this article. The number of licensed operators changes over time. As of March 2026, the official list contained 25 digital financial asset traders, and by May 2026, the number had become 26. This means any list you find on a blog, including the figures in this article, may already be inaccurate by the time you read it. Always open the live list on the OJK website; do not rely on copies found elsewhere.
Step 2: Match the legal entity name, not the app name
This is the step most often skipped, yet it is the most decisive.
The OJK list is not organized by app name, but by legal entity name. Each row contains the PT (limited liability company) name along with its brand or application. For example, Mobee is registered under the legal entity PT CTXG Indonesia Berkarya.
Why is this important? Because the app name is the easiest layer to imitate. Illegal platforms often use names similar to licensed platforms or use names that sound convincing but do not exist on any list. As long as you only match the app name, you are still evaluating a layer that can be faked.
How to do it. Find the legal entity name of the platform you are using, which is usually listed on the terms and conditions page, the privacy policy page, or at the bottom of the app. Then match that PT name, letter by letter, with the one on the OJK list. If the app name matches but the PT name is different, or if the platform never mentions its legal entity anywhere, that is reason enough to stop.
Step 3: Ask about the custodian, where your assets are actually stored
This is the least known step, yet it is the most critical filter.
In Indonesia, crypto asset trading is not handled by a single company alone. The structure is divided into several roles, each requiring a separate license: the exchange where transactions are recorded, the clearinghouse that guarantees transaction settlement, the custodian that holds the assets, and the trader, which is the platform you use daily.
This separation is not just an administrative formality. The point is simple: your assets are not held by the platform where you trade. If the trading platform runs into trouble, your assets don't disappear with it, because the assets aren't actually there.
Why this question is hard for illegal platforms to answer. The number of licensed crypto asset custodians in Indonesia is very small, and according to the latest official list, there is only one: PT Kustodian Koin Indonesia. A truly licensed platform will be able to name it without hesitation because that is where their users' assets are placed. Illegal platforms have no answer, because your assets are either stored in their own wallets or were never used to purchase assets at all.
How to do it. Ask customer service directly: "Which custodian holds my assets?" The correct answer is a specific company name. Vague answers like "stored in our cold wallet," "stored with multi-layered security systems," or "stored on encrypted servers" are not answers to that question. Those are answers about technology, while you are asking about who.
Why you need all three.
Most people who get scammed have actually performed one check. They see an OJK logo or find a similar name on a list, and then feel safe.
These three steps are designed to cover each other's gaps. Step 1 ensures you are looking at the right source. Step 2 ensures you are verifying an identity that cannot be forged. Step 3 ensures the license is actually being practiced, not just existing on paper. Passing two out of three does not mean you are safe, because the remaining gap is exactly the one usually exploited.
Five Red Flags That Should Make You Stop
If the three steps above are a planned inspection, this section is an alarm. You don't need to overanalyze the following five things. If even one appears, stop immediately.
1. Promising fixed returns or "guaranteed profits"
Crypto asset prices fluctuate every second, and no one can control them. Therefore, anyone promising a fixed profit rate, such as 5% per month or "guaranteed profits," is promising something that is structurally impossible to fulfill from trading results.
If the profit isn't from trading, where does the money come from? Usually from the deposits of new members. That pattern has a name and always has the same ending.
2. Offering registration bonuses you never signed up for
You suddenly receive a message saying your account has been created, a bonus balance has been added, and it's ready to be withdrawn. Even though you never registered.
The goal isn't to give you money. The goal is to get you into the app to see a balance figure. Once you see that number, you stop evaluating the platform and start thinking about how to withdraw it, and that is the point where a deposit request appears.
3. Claiming to be an Admin, but DMing you first
Official platforms never contact you first via private message regarding account or fund matters. Even if there is communication, it is always initiated by you to their official channels, not the other way around.
Accounts using names and profile photos that mimic official admins, then sending unsolicited DMs on Telegram, WhatsApp, or Instagram, are almost always scams. This follows the same pattern as email phishing, the characteristics of which you can learn about at signs of phishing emails.
4. Withdrawals that require an upfront deposit
This is the most definitive sign on the entire list, as it appears once your money is already inside.
The reasons can vary: taxes, administrative fees, verification fees, or security deposits. While the excuses differ, the logic is always the same: you are asked to send additional money so that your own funds can be released.
Licensed platforms deduct fees from your balance, they do not ask you to make another transfer. If you are asked to deposit funds to make a withdrawal, that additional money will not unlock anything, and it will almost certainly be followed by further requests.
5. Requesting OTP or 2FA codes
OTP and 2FA codes are specifically designed so that no other party, including the platform itself, can access your account. Therefore, there is no legitimate reason for anyone to ask for them.
No official customer service representative needs that code. No verification process requires that code. As soon as someone asks for it, for any reason, the conversation is over. The basic concept is discussed further in what is KYC, which explains what data is reasonable for a platform to request and what data is never appropriate to share.
If You Have Already Been Affected
If, after reading this, you realize the platform you are using fails on any of these points, there are several steps you should take in order.
Stop depositing, regardless of the reason. If your withdrawal is held up and they ask for an additional deposit to unlock it, that is not a procedure but a continuation of the scam. Adding more deposits only increases your losses.
Gather evidence now, before it disappears. Save screenshots of conversations, proof of transfer, account names and destination bank account numbers, links to the app or website, and your transaction history within the app. Illegal platforms usually delete accounts and groups as soon as complaints start to mount.
Report it to the PASTI Task Force. The PASTI Task Force, short for the Task Force for Combating Illegal Financial Activities, is a task force under the OJK that handles illegal financial activities. Their official channel: call the OJK Contact Center at 157, WhatsApp at 081157157157, or email satgaspasti@ojk.go.id.
Also report it to the police if you have suffered financial losses, and to the bank where you made the transfer, especially if the transfer just occurred.
FAQ
Check the Platform You Are Currently Using
If you have reached this point but haven't actually opened the OJK list, take two minutes to do so now. This check is only useful if you take action, not just read about it.
Mobee operates under the legal entity PT CTXG Indonesia Berkarya and is registered as a Digital Financial Asset Trader supervised by the OJK. That name is written in full here so you can verify it yourself on the official list, exactly as you should do with any platform, including the one whose article you are reading right now.
If you want to understand the regulatory framework in more depth, the discussion can be found in crypto legality in Indonesia and the list of OJK-supervised crypto exchanges. For account security and asset storage, start with how to store assets securely.
Disclaimer. This content is for educational purposes only and does not constitute investment advice. Crypto assets are high-risk and subject to price volatility. Information regarding licensed providers, the number of entities, and licensing structures is based on official OJK publications available as of September 2026 and is subject to change. Always verify information directly with official sources before making any decisions.
Source: Data on 228 illegal crypto asset platforms shut down between January and May 2026, based on statements from the OJK and the PASTI Task Force. The list of digital financial asset trading providers and licensing structures is derived from official OJK publications, including the whitelist press release SP 226/GKPB/OJK/XII/2025 dated December 19, 2025, and provider lists from March and May 2026. Reporting channels for the PASTI Task Force are sourced from the OJK Waspada Investasi portal. Compiled on September 15, 2026.
