AI is magnifying risks for Indonesia's digital citizens, but it is also helping to root out fraud at an earlier stage.

Safdar Khan, Division President, Southeast Asia, Mastercard   

Motorcycle taxi drivers getting customers from ride-hailing apps. Night market stall keepers selling handicrafts online. Family-run noodle shops taking delivery orders for dispatch across the city.

The rise of the platform economy, along with the urgency triggered by the pandemic to digitalize, has helped Southeast Asian emerging markets to leapfrog into modernity.

Southeast Asia is a vibrant, booming economy with over 400 million internet users, representing one of the world's fastest-growing digital populations^[1]. Historically underbanked populations are now embracing technology to access a wide range of financial services through app- and platform-based offerings. In ASEAN, the digital payments market is projected to reach US$286 billion in total transaction value in 2024^[2], with Indonesia contributing approximately 35 percent of this total, or US$102 billion^[3].

The development of a strong digital ecosystem has also fostered innovation and growth across multiple sectors in the country, including e-commerce, digital payments and online services, establishing Indonesia as one of the key players in the global digital economy.

This is great news for financial inclusion, especially in Indonesia where nearly 48 percent of all adults, or 98 million people, do not have a bank account or lack sufficient access to financial services, according to the World Bank.

However, this rapid digital expansion brings new challenges. Indonesia ranks 48th out of 176 countries on the global cybersecurity index and fifth in Southeast Asia, underscoring the urgent need for enhanced measures to boost cybersecurity in the nation.

This also comes at a complex time in technology evolution. As the digital economy grows, the rise of artificial intelligence, in particular generative AI, has made broadly available a powerful tool that can exacerbate the threat of fraud against a newly online population. As criminals begin to use AI, organizations within the financial system must also deploy this technology to thwart them.

Often, but not always, the kinds of attacks being scaled up using AI are those that may have previously required human input. One common tactic is "spear-phishing," in which victims are sent seemingly authentic emails containing links that can trigger malware if clicked. Another tactic is payment fraud in which a scammer impersonates someone trustworthy to persuade a target to make a money transfer.

AI has also fueled identity fraud. Cybercriminals today harness AI to exploit system weaknesses and steal valuable information, which can then be sold on the dark web. Then, by leveraging stolen identity information, they devise sophisticated schemes such as using deepfakes to execute fraud attacks, complicating fraud mitigation efforts.

Generative AI helps fraudsters smooth out telltale imperfections that can belie their tactics while also magnifying the volume of their attacks. Such scams can disproportionately affect vulnerable segments of society.

Cybercrime is already a pressing issue in the Asia-Pacific region. According to IBM, the region accounted for 23 percent of all cyber incidents globally in 2023^[4]. Recent data from the National Cyber and Crypto Agency (BSSN) reveals that Indonesia faced over 403 million anomalous traffic events in 2023 alone^[5].

It is essential that everyone involved in the digital economy plays their part in combating fraud. For major entities, including large payment companies and financial institutions, this means developing and applying the most advanced tools, including AI-powered solutions, to meet fraudsters at the level on which they operate or higher.

This is because AI and machine learning have made it possible to catch criminals earlier, by analyzing patterns and data points to identify fraudulent behavior in real time.

In 2023, AI models enabled Mastercard to safeguard more than 143 billion transactions on our global network by using billions of data points to analyze things like how users hold their phones and type on their keyboards and when and where a transaction is taking place to identify patterns of possible fraud and allow real human interaction to be distinguished from bot-based manipulations. This has prevented US$20 billion in potential fraud losses from attempted global fraud and cybercrime attacks between 2022 and 2023.

Across our industry, network intrusion-detection systems are now able to actively monitor and identify suspicious behavior using machine learning. AI is being harnessed to detect deepfake videos with nearly 100 percent accuracy by analyzing the movement of facial features and audio quality for telltale signs of manipulation. Identity protection solutions scour the deepest corners of the Internet – including the dark web – to search for compromised credentials and potentially damaging use of personal information, and alert users if any suspected identity theft has been found.

These new approaches go beyond ensuring security and the validity of transactions. We are moving toward a future in which AI can ensure the trustworthiness of digital interactions.

As the number of participants in Indonesia's digital economy surges, there are many more entry points that can be exploited by criminals. This could be a single consumer or an intern at a small start-up. It could be a point-of-sale system at a corner shop.

While an attack through one of these vulnerable entities is unlikely to immediately have far-reaching effects throughout the ecosystem, that is cold comfort for shoppers or small businesses whose livelihoods can be severely impacted, especially in a market in which many lack a financial safety net.

In the longer term, such attacks will discourage those affected and those around them from using digital services. This will not bode well for Southeast Asian digital economies looking to drive greater inclusion and digital trust, such as Indonesia.

The vulnerabilities at all levels of the digital ecosystem require a united approach to defense. While educational outreach for individual consumers and workers will continue to be imperative, the responsibility for building and fortifying AI-enhanced cybersecurity will largely fall on entities at higher echelons within the system, such as banks, governments, corporations and payment networks.

We are already seeing governments partnering with the private sector on digital security. For example, Indonesia’s Communications and Information Ministry has partnered with the Indosat-Mastercard Cybersecurity Center of Excellence to launch an online academy that will boost cyber awareness of Indonesians by making essential everyday cybersecurity skills easy to understand and accessible via a digital platform.

But not all solutions will be top-down. New cybersecurity technologies deployed by high-level entities may end up coming from start-ups or fintechs that have been able to develop innovative ways of using AI to fight fraud.

Partnerships will bring together entities that have the ability to innovate quickly with those which can implement at scale. Since 2018, Mastercard has invested more than US$7 billion globally into cybersecurity capabilities and contributed to the launch of more than 20 cybersecurity-focused startups.

As Indonesia's digital economy continues to expand, it is vital for all stakeholders, including the public sector, academia, private sector companies of all sizes across all industries,- and individuals, to unite in bolstering cybersecurity and digital trust.

Security systems are only as strong as their weakest points. Connected and collective action can help ensure the benefits of digitalization are both sustainable and broadly felt.

This article has been adapted from a version originally published in Nikkei Asia.

The ideas expressed here do not represent The Jakarta Post's views and policies