A Reddit user applied for three B1 e‑visas via the official portal and, within 24 hours, received a phishing email from noreplyarrivalcardidn@arrivalcardsubmission.online that:
- Included the correct full names of all applicants and the correct official confirmation/registration number from their e‑visa application
- Claimed to be from Indonesian Immigration and said you must pay for an “arrival card” via a link (arrivalcardsubmission.online) that tries to get you to buy USD‑backed crypto
Because the scammers had accurate application data so quickly, there’s concern that either the official e‑visa system or someone with internal access is leaking recent applicants’ details, not just scraping random emails.
For Aussies headed to Bali and Indonesia in general, note:
- The “arrival card” in that email is a scam – ignore and delete it
- The legitimate, free online arrival card is only at https://allindonesia.imigrasi.go.id/ or the official “All Indonesia” app, which gives you a QR code checked at the airport
- Real Indonesian government domains end in .go.id, not .online
Has anyone here who recently used the official e‑visa site, received similar emails or noticed anything suspicious after paying for Bali visas online?
There was someone also who mentioned their Wise credit card was also used for unauthorized transactions after using the official site.
Maybe better to get the VOA at the airport instead of online.
Added to my already comprehensive list of why never to waste my time going to Bali. Cheers