Regulating Phishing and Digital Impersonation in Indonesia: Assessing the Effectiveness and Limitations of the ITE Law

Abstract

Phishing and digital impersonation have become significant cybercrime concerns in Indonesia because they exploit electronic transactions, institutional trust, and users’ limited ability to verify digital identities. This study examines two main questions: to what extent the Electronic Information and Transactions Law (ITE Law) effectively regulates phishing and digital impersonation, and why these offenses urgently require legal assessment. Using a normative juridical approach, the study analyzes statutory provisions, legal concepts, scholarly literature, and selected public cases involving fake customer service accounts and phishing schemes. The discussion shows that Articles 28 paragraph (1), 30, 35, and 51 of the ITE Law provide a legal basis for addressing misleading information, unauthorized access, and manipulated electronic information. However, the law remains limited because phishing and digital impersonation are not expressly formulated as independent offenses, creating fragmented interpretation and evidentiary challenges. The study concludes that Indonesia needs clearer legal interpretation, stronger institutional coordination, and more preventive regulatory mechanisms to improve legal certainty, consumer protection, data security, and public trust in digital services.