Often enough, spammers slide into the replies of popular tweets. But recently, in Indonesia, there’s a new type of reply appearing under viral posts. These are notes left by accounts that sell access to various streaming and utility platforms, like Netflix, Spotify, Zoom, and Canva.
These accounts are not commissioned by international platforms for a marketing blitz. Rather, they are selling access offered by gray market traders who deal in illegal logins at a fraction of the officially set prices.
These dealings come at a time when the the COVID-19 pandemic has forced many Indonesians to spend much, much more time at home, venturing out of their residences only for necessities like food and daily goods. Screens and high-speed internet connections have become central to the lives of many households. We need them for work, entertainment, and even socialization from a distance. But every byte of data that moves across fiber optic cables or through cellular devices carries a price tag.
Yet adjustments made by businesses during the pandemic have slashed the household incomes of many people across the country—at a time when Indonesia is on the brink of a recession. This gray market serves to maintain their (web-hosted) creature comforts, or in some cases necessary tools for their jobs.
Think of this as the next step beyond pirated DVDs, copied software, and websites that illegally stream films and TV series. A 2019 joint survey by the Asia Video Industry Association’s Coalition Against Piracy and market research company YouGov found that 63% of online consumers in Indonesia favor watching movies for free through illegal websites, forgoing the array of subscription-based streaming services that are available in the country.
Cost, convenience, and keeping up with the hype
The country’s Communications and Information Ministry has already blocked at least 1,000 illegal movie-streaming sites since last year. Yet, that has only shifted consumers over to the gray market for logins.
Sellers who have passwords to hawk let them go for cut rates. Netflix’s basic plan will cost 120,000 rupiah (USD 8.20) starting in September, after a 10% hike due to the newly imposed 10% value-added tax on digital services provided by foreign companies, but the same service can be acquired illegally for 95,000–100,000 rupiah (USD 6.50–6.80) per month.
Premium access on Spotify, which normally costs 50,000 rupiah per month and lets users skip ads and download songs to their devices, goes for one-fifth the price, and bundling three months at a time with a gray market vendor provides an even steeper discount at 22,000 rupiah. One year’s access to Canva can be bought for 40,000 rupiah from an illegal seller, while its official price is 499,000 rupiah.
Cheap rates on the gray market are the key attraction, as several people who have purchased illegal access told KrASIA. “I keep using these features because of the price point,” said Yudha, a journalist. He added that it’s “slightly better” than arranging a subscription with Netflix because, as a consumer, he gets the same level of access.
Yudha found the seller in a Telegram group and only needed to pay two dollars per month for Netflix. But it didn’t take long for a snag to come up—three other people were using the same account, and someone else had changed the password, blocking his access. After this happened, the seller provided Yudha with a new set of credentials so he could keep streaming, but he eventually decided to subscribe to Netflix’s cheapest plan instead.
That doesn’t mean Yudha shook off the habit altogether. He still uses an illegal login for digital writing tool Grammarly.
Read this: ‘This is just a warning from me’ — How Grab and Gojek are utilized to intimidate activists in Indonesia
Aside from social media, Indonesia’s account peddlers are active on e-commerce platforms too. Hans, who did not wish to disclose his full name for this article, said that his first purchase was made on Tokopedia, one of the country’s largest e-commerce marketplaces. “I found a seller who sold a one-year account [for Netflix] for only 100,000 rupiah. But I need to change accounts every month, [with new logins] given by the seller,” he said.
Unlike Yudha, Hans encountered no problems when he was using shared credentials. And the sign-up process was simple to begin with. “I only have to pay, there’s no need to provide other info, such as e-mail or card number,” he said. However, three months into it, he decided to register his own account on Netflix, splitting the payments with a friend.
A person who goes by the name Foust told KrASIA that he bought access to hacked Canva and Netflix accounts from a contact on Facebook. “Usually, I transferred the money directly to their bank account, but now it’s easier since the store is on Shopee,” he said.
Gray market sellers that operate on e-commerce portals offer one convenience, according to another person who spoke to KrASIA, Dian. Simply put, they offer more payment options than the streaming services and other cloud-based services, which typically only charge via Paypal, credit card, or debit card. Netflix users in Indonesia can pay using phone credit, but there is an additional fee of 10,000 rupiah.
But third-party sellers on the gray market accept transfers by Ovo, Dana, and GoPay. “I just don’t want to pay using my credit card,” Dian said.
As one of the countries with the highest number of internet users in the world, there are times when the local populace feels left out of services that are widely available around the globe. Disney+, for instance, will finally be available in early September, while Hulu has yet to formulate a plan for this market. If Indonesians don’t want to miss out on the hype surrounding, say, the musical Hamilton, the gray market for logins offers access, as long as customers have their own VPNs.
Not worth a crackdown?
Most of these sellers of logins tell customers that their services are legal. Some claim to only pool people together based on the intended limitations of a subscription package, such as Spotify and Netflix’s family plans. Or they might create new profiles using free trials, which may explain the necessity for their customers to switch to new accounts each month. Could users manage this on their own? Yes, but think of the gray market as an instrument of convenience.
A 2016 research report by digital security company Symantec mentioned a black market for Netflix accounts. The merchants restock by breaching the accounts of legitimate subscribers who pay for plans that allow viewing on multiple gadgets, or they hire hackers to do so. Information from the hack—specifically email addresses or usernames, along with matching passwords—are then sold to people who want to pay a little less for full service. When this happens, sellers warn buyers not to trip any wires, like changing the password, that may alert the original user whose account was compromised.
Some other parties use account generators, which are filled with stolen Netflix subscriptions or payment details. The people who populate these generators regularly update the roster with new accounts and remove ones that are no longer active. It is likely that Indonesia’s login merchants use this channel to make monthly sales.
A spokesperson for Canva confirmed to KrASIA that the company regards account reselling as fraud. “While we can’t publicly disclose the specific systems and measures in place to mitigate this behavior, accounts engaging in these activities may be terminated in line with our Terms of Use,” the spokesperson said.
Read this: What can we learn from Tokopedia’s alleged leak of 91 million users’ data?
Netflix and Spotify haven’t responded to KrASIA’s request for comment. However, both companies state in their terms of use that the platforms’ services and contents are strictly for non-commercial use, which means that selling accounts for personal profit is a violation and may lead to account termination.
People who buy logins on the cheap may not think they are breaking any rules—after all, they use working, valid passwords. But companies see the matter in a different light. As often as possible, people who are skirting the rules are banned, even if ineffectively, as soon as they are discovered.
However, these platforms still lack strict measures for detection and cancellation. For now, the gray market brokers are still actively promoting and trading massive spreadsheets full of usernames and passwords on social media, as well as on Indonesia’s most popular e-commerce platforms, for a few dollars at a time.