How Indonesian Banks Use Voice AI for Account Risk Notifications

Banks in Indonesia use AI voice agents to call customers about account risks: a login from a new device, a change to registered contact details, a large transfer, an account about to go dormant, or a credit limit change. The agent tells the customer what happened, asks them to confirm it was them, and escalates to the fraud or service team when it wasn’t. A call gives the customer a direct way to confirm or deny the event, and it creates a recorded confirmation.

Risk notifications are short calls with one goal: confirm or stop.

Which Risk Events Need a Call

New device or login. A customer’s mobile banking is activated on a new phone.

Contact detail changes. The registered phone number or email is changed. Fraudsters do this first, so the customer’s old number gets the call.

Large or unusual transfers. A transfer far outside the customer’s usual pattern.

Dormant accounts. An account is about to become dormant, and the customer can keep it active.

Limit changes. A credit limit increase or decrease the customer should know about.

How a Risk Notification Call Works

Step 1. The event triggers a call. The bank’s risk system sends the event, the customer and the urgency.

Step 2. The agent identifies the bank and the reason. It mentions the event without reading out sensitive details.

Step 3. The customer confirms or denies. One question: “Was this you?”

Step 4. The system acts. Confirmed events are closed. Denied events freeze the change or the account and go to the fraud team with a summary.

Step 5. Unreached customers get a second channel. A WhatsApp or SMS message with the official hotline number follows.

Rules That Shape These Calls

This article summarises published regulation and commentary. It is not legal advice.

Consumer protection. OJK’s POJK 22/2023 requires financial services providers to give consumers clear, accurate information and to handle complaints. A risk notification should tell the customer exactly what happened and what to do next.

Personal data. Account events are personal data, and financial details are specific personal data under Indonesia’s PDP Law, Law No. 27 of 2022. Only say what’s needed on the call.

Breach response. If an event turns out to be part of a data breach, Article 46 of the PDP Law requires written notification within 3 x 24 hours.

How to Keep Customers From Mistaking You for a Scammer

Never ask for secrets. No PINs, passwords, card numbers or one-time codes. State this at the start of every call.

Ask yes-or-no questions. “Was this you?” is safer than asking the customer to repeat details.

Give a way to call back. Tell customers they can hang up and call the number on their card or the bank’s website.

Publish your rules. List on your website what genuine calls do and never do.

What a Good Risk Notification Sounds Like

AI voice agent: Selamat siang, saya asisten virtual dari bank Anda. Kami tidak akan pernah meminta PIN, kata sandi, atau kode OTP. Apakah saya berbicara dengan Bapak Hendra?

Customer: Ya, saya sendiri.

AI voice agent: Kami mendeteksi aktivasi mobile banking Bapak di perangkat baru hari ini pukul 10.15. Apakah itu Bapak sendiri?

Customer: Bukan, saya tidak ganti HP.

AI voice agent: Baik, akses dari perangkat tersebut sudah kami hentikan. Saya sambungkan Bapak ke tim keamanan kami sekarang.

How Local Rules Compare With US and EU Guidance

Buyers often ask how local rules compare with US and EU guidance. These references help.

NIST SP 800-63B. NIST’s US digital identity guidelines class one-time codes sent by SMS or voice call as a “restricted” authenticator, because phone numbers can be hijacked through SIM swaps. They also say biometrics shouldn’t be used alone. A voiceprint can support a check, and it should sit alongside something the customer has, such as an approved device.

NIST AI Risk Management Framework. NIST’s AI RMF 1.0, published in January 2023, organises AI risk work into four functions: govern, map, measure and manage. It stresses human oversight, documentation and ongoing monitoring.

Common Failure Points

Calling the new number. When contact details change, call the old one too.

Too much detail on the call. Mention the event and leave the account balance out.

Slow escalation. A denied event needs a person within minutes.

No record. Store the confirmation as evidence.

Practical Considerations

AI Rudder has an office in Indonesia, runs AI voice agents in 22 markets and has executed more than 80 billion AI calls. Its AI voice agent and AI chat agent work together, so an unanswered call can be followed by a WhatsApp message. It is built to meet SOC 2 and ISO 27001, alongside GDPR and PDPA requirements. AI Rudder is named in Tech in Asia’s Singapore’s Top Fintech Companies 2027 list, in the Enterprise Fintech category.

Frequently Asked Questions

How do banks use voice AI for risk notification?
An AI voice agent calls when a risk event happens, asks the customer to confirm it, and escalates denials to the fraud team.

Which events should trigger a call?
New device logins, contact detail changes, unusual transfers, dormancy warnings and limit changes.

Why call when the app already sends a notification?
A notification can go unread. A call lets the customer confirm or deny the event and creates a recorded answer.

What if the customer doesn’t answer?
Send a message with the official hotline and retry within your policy.

Next Step

List the risk events your app notifies today. Get a Demo and we’ll show you which ones are worth a call.