Reconstructing the Civil Liability of Banks for Social Engineering Fraud in Indonesia’s Digital Banking Ecosystem: Vitiated Consent, Duty of Care and Risk-Based Loss Allocation

The migration of Indonesian banking into fully digital channels has been accompanied by an escalation of social engineering fraud, in which offenders manipulate account holders into authorising transfers that are technically valid but substantively involuntary. Indonesian positive law contains no norm allocating the resulting loss. In that vacuum, banks rely on the validity of the one-time password (OTP) or PIN and on standard-form exoneration clauses to place the entire burden on the customer, whose bargaining position and evidentiary access are structurally inferior. This article asks whether the doctrine of vitiated consent (wilsgebreken) can qualify a manipulated transfer instruction as a legally defective expression of will, and how the duty of care doctrine should be expanded to reallocate the bank’s civil liability. The study applies normative legal research combining statutory, conceptual and case approaches, supported by semi-structured interviews with a bank legal division head and a legal academic, and analysed through deductive legal syllogism. The findings are threefold. First, an instruction produced by social engineering materially satisfies the elements of mistake (dwaling, Article 1322 of the Civil Code) and fraud (bedrog, Article 1328), so that authentication verifies identity but not will. Second, the standard applicable to a bank as a professional electronic system operator already encompasses behavioural anomaly detection, because Articles 18(2) and 26 of Law No. 8 of 2010 require that capability for anti-money-laundering purposes; failure to deploy it for the customer’s protection is an omission actionable under Articles 1365 and 1366. Third, Article 28 of the Consumer Protection Law already reverses the burden of proving fault, and needs application rather than creation. The article proposes a bounded risk-based liability model with a rebuttable presumption against the bank, a safe harbour and proportionate loss sharing, benchmarked against the United Kingdom’s mandatory reimbursement scheme and Singapore’s Shared Responsibility Framework.

Banking Law, Civil Law

1. Nursetyo, A. (2019). Prinsip kehati-hatian bank dalam penyelenggaraan digital banking di Indonesia. Jurnal Hukum & Pembangunan, 49(2). [Google Scholar] [Crossref]

2. Sudarmono, N. M. (2023). Adaptasi regulasi persaingan usaha dalam bidang perbankan digital. Jurnal Studia Legalia, 4(1), 60–71. https://doi.org/10.61084/jsl.v4i01.65 [Google Scholar] [Crossref]

3. Khumairok, M. (2023). Regulasi hukum perbankan dalam menghadapi tren inovasi fintech dan keberhasilan industri perbankan di era society 5.0. Jurnal Multidisiplin Indonesia, 2(7), 1719–1731. https://doi.org/10.58344/jmi.v2i7.335 [Google Scholar] [Crossref]

4. Anjani, N. H. (2021). Kondisi keamanan siber di Indonesia. Ringkasan Kebijakan, 9, 1–12. [Google Scholar] [Crossref]

5. Muhammad, A. (1990). Hukum perdata. Citra Aditya Bakti. [Google Scholar] [Crossref]

6. Ramadanti, N., & Suwantoro, H. (2023). Pertanggungjawaban perdata penyelenggara jasa perbankan digital atas kerugian nasabah akibat kebocoran data pribadi. Jurnal Hukum Transnasional, 7(1), 88–100. [Google Scholar] [Crossref]

7. Sjahdeini, S. R. (2020). Hukum tata kelola teknologi informasi perbankan. Pustaka Utama Grafiti. [Google Scholar] [Crossref]

8. Savitri, A. R. (2021). The duty of care of banks in digital banking transactions: A comparative perspective. Indonesian Journal of International Law, 18(4), 57–67. [Google Scholar] [Crossref]

9. Hadjon, P. M. (2007). Perlindungan hukum bagi rakyat Indonesia: Sebuah studi tentang prinsip-prinsipnya, penanganannya oleh peradilan dalam lingkungan peradilan umum dan pembentukan peradilan administrasi negara. Peradaban. [Google Scholar] [Crossref]

10. Sitompul, Z. (2002). Perlindungan dana nasabah bank: Suatu gagasan tentang pendirian lembaga penjamin simpanan di Indonesia. Fakultas Hukum Universitas Indonesia. [Google Scholar] [Crossref]

11. Apriani, T. (2021). Konsep ganti rugi dalam perbuatan melawan hukum dan wanprestasi serta sistem pengaturannya dalam KUH Perdata. Ganec Swara, 15(1), 929. https://doi.org/10.35327/gara.v15i1.193 [Google Scholar] [Crossref]

12. Widjaja, G. (2008). Risiko hukum dalam bisnis. Forum Sahabat. [Google Scholar] [Crossref]

13. Zulham. (2017). Hukum perlindungan konsumen. Kencana Prenada Media. [Google Scholar] [Crossref]

14. Sinaga, N. A. (2015). Pelaksanaan perlindungan konsumen di Indonesia. Jurnal Ilmiah Hukum Dirgantara, 5(2). [Google Scholar] [Crossref]

15. Subekti, R. (1995). Aneka perjanjian. Citra Aditya Bakti. [Google Scholar] [Crossref]

16. Setiawan, R. (2016). Hukum perjanjian dan jaminan. Kencana. [Google Scholar] [Crossref]

17. Thalib, A., & Aisyah, N. (2021). Hukum perjanjian. Rajawali Pers. [Google Scholar] [Crossref]

18. Fatimah Mediawati, N., & Purwaningsih, S. B. (2018). Hukum kontrak dan perikatan. Umsida Press. [Google Scholar] [Crossref]

19. Mertokusumo, S. (2019). Mengenal hukum: Suatu pengantar. Maha Karya Pustaka. [Google Scholar] [Crossref]

20. Ekawati, D. (2018). Perlindungan hukum terhadap nasabah bank yang dirugikan akibat kejahatan skimming ditinjau dari perspektif teknologi informasi dan perbankan. UNES Law Review, 1(2), 157–171. https://doi.org/10.31933/law.v1i2.24 [Google Scholar] [Crossref]

21. Mahiswari, A. A. S., & Utama, I. M. A. (2020). Tanggung jawab bank terhadap kerugian nasabah akibat kegagalan sistem dalam transaksi mobile banking. Jurnal Ilmu Hukum, 8(8). [Google Scholar] [Crossref]

22. Setiyono, H. (2020). Rekonstruksi pertanggungjawaban pidana dan perdata dalam kejahatan perbankan di era teknologi informasi. Jurnal Hukum Ius Quia Iustum, 27(1). [Google Scholar] [Crossref]

23. Handayani, I. G. A. K. R. (2022). Legal protection for bank customers as consumers in electronic banking transactions. Journal of Legal, Ethical and Regulatory Issues, 23(5). [Google Scholar] [Crossref]

24. Marzuki, P. M. (2005). Penelitian hukum (rev. ed.). Prenada Media Group. [Google Scholar] [Crossref]

25. Ali, Z. (2009). Metode penelitian hukum. Sinar Grafika. [Google Scholar] [Crossref]

26. Soekanto, S. (2014). Pengantar penelitian hukum. UI Press. [Google Scholar] [Crossref]

27. Idris, M. (2019). Kerahasiaan bank suatu tinjauan dalam aturan hukum perbankan syariah di Indonesia. Al-Amwal: Journal of Islamic Economic Law, 1(1), 1–29. https://doi.org/10.24256/alw.v1i1.624 [Google Scholar] [Crossref]

28. Sutedi, A. (2010). Hukum perbankan: Suatu tinjauan pencucian uang, merjer, konsolidasi, dan akuisisi. Sinar Grafika. [Google Scholar] [Crossref]

29. Dewi, S. (2016). Cyberlaw: Perlindungan privasi data pribadi dalam digital economy. Socio-Humaniora, 18(2). [Google Scholar] [Crossref]

30. Lingga Syailendra Arief, & Purwanto, R. (2025). Tinjauan yuridis Undang-Undang Perlindungan Data Pribadi Tahun 2022 dalam menangani kebocoran data pelanggan e-commerce. Pemuliaan Keadilan, 2(3), 85–102. https://doi.org/10.62383/pk.v2i3.1019 [Google Scholar] [Crossref]

31. Fista, Y. L., Machmud, A., & Suartini. (2023). Perlindungan hukum konsumen dalam transaksi e-commerce ditinjau dari perspektif Undang-Undang Perlindungan Konsumen. Binamulia Hukum, 12(1), 177–189. https://doi.org/10.37893/jbh.v12i1.599 [Google Scholar] [Crossref]

32. Harahap, Y. (2015). Hukum acara perdata: Tentang gugatan, persidangan, penyitaan, pembuktian, dan putusan hakim. Sinar Grafika. [Google Scholar] [Crossref]

33. Payment Systems Regulator. (2023). Fighting authorised push payment scams: Final decision (Policy Statement PS23/4). Payment Systems Regulator. [Google Scholar] [Crossref]

34. Monetary Authority of Singapore & Infocomm Media Development Authority. (2024). Guidelines on Shared Responsibility Framework. Monetary Authority of Singapore. [Google Scholar] [Crossref]

35. Friedman, L. M. (2011). Sistem hukum: Perspektif ilmu sosial. Nusa Media. [Google Scholar] [Crossref]

36. Mathilda, F. (2012). Cyber crime dalam sistem hukum Indonesia. SIGMA-Mu, 2(2), 34–45. [Google Scholar] [Crossref]

37. Panggabean, H. P. (2010). Penyalahgunaan keadaan (misbruik van omstandigheden) sebagai alasan (baru) untuk pembatalan perjanjian: Berbagai perkembangan hukum di Belanda dan Indonesia. Liberty. [Google Scholar] [Crossref]

38. Agustina, R. (2003). Perbuatan melawan hukum. Program Pascasarjana Fakultas Hukum Universitas Indonesia. [Google Scholar] [Crossref]

39. Fuady, M. (2002). Perbuatan melawan hukum: Pendekatan kontemporer. Citra Aditya Bakti. [Google Scholar] [Crossref]

40. Miles, M. B., Huberman, A. M., & Saldaña, J. (2014). Qualitative data analysis: A methods sourcebook (3rd ed.). Sage Publications. [Google Scholar] [Crossref]

43. Legislation, Regulations and Industry Instruments [Google Scholar] [Crossref]

44. Kitab Undang-Undang Hukum Perdata (Burgerlijk Wetboek). [Google Scholar] [Crossref]

45. Law No. 7 Year 1992 on Banking, as amended by Law No. 10 Year 1998. [Google Scholar] [Crossref]

46. Law No. 8 Year 1999 on Consumer Protection. [Google Scholar] [Crossref]

47. Law No. 11 Year 2008 on Information and Electronic Transactions, as amended by Law No. 19 Year 2016 and by Law No. 1 Year 2024. [Google Scholar] [Crossref]

48. Law No. 8 Year 2010 on Prevention and Eradication of Money Laundering. [Google Scholar] [Crossref]

49. Law No. 27 Year 2022 on Personal Data Protection. [Google Scholar] [Crossref]

50. Law No. 4 Year 2023 on Development and Strengthening of the Financial Sector, as amended by Law No. 4 Year 2026. [Google Scholar] [Crossref]

51. Financial Services Authority Regulation Number 22 of 2023 concerning Consumer and Public Protection in the Financial Services Sector. [Google Scholar] [Crossref]

52. Financial Services Authority Regulation Number 44 of 2024 concerning Bank Secrecy. [Google Scholar] [Crossref]

53. 2023 Indonesian Banking Regulation regarding the Suspension of Fund Transfer Transactions. [Google Scholar] [Crossref]

54. Payment Systems Regulator (United Kingdom), Specific Directions 19, 20 and 21 (authorised push payment reimbursement), in force 7 October 2024. [Google Scholar] [Crossref]

55. Monetary Authority of Singapore and Infocomm Media Development Authority, Guidelines on Shared Responsibility Framework, in force 16 December 2024. [Google Scholar] [Crossref]

56. Court Decisions [Google Scholar] [Crossref]

57. Mahkamah Agung Republik Indonesia, Decision No. 1904 K/Sip/1982, 28 January 1984. [Google Scholar] [Crossref]

58. Mahkamah Agung Republik Indonesia, Decision No. 3431 K/Pdt/1985, 4 March 1987 (Sri Setianingsih v. Ny. Boesono and R. Boesono). [Google Scholar] [Crossref]

59. Mahkamah Agung Republik Indonesia, Decision No. 3641 K/Pdt/2001. [Google Scholar] [Crossref]

60. Mahkamah Agung Republik Indonesia, Decision No. 3406 K/Pdt/2019, 16 December 2019. [Google Scholar] [Crossref]

• The Impact of Digital Supply Chain Integration on Customer Experience in the E-Commerce Sector
• Analysis of the Implementation of Digital-Based Public Information Transparency and Public Communication at the District Attorney’s Office of Tasikmalaya City
• Development of Soft Skills in Schoolchildren: Integrating Pedagogical Strategies, Digital Technologies, and Community Practices
• Youth Cybercrime, Peer Networks, and Digital Deviance in Urban Lagos: A Social Learning Perspective