A story about online loans, one very confused calculator, and five apps pretending to be someone they're not.
Let's start with a loan
Imagine you borrow Rp1.000.000 from an app on your phone. That's the number on the contract.
But when the money lands in your account, it's only Rp800.000. The app kept Rp200.000 as an "admin fee." Fine, whatever.
Thirty days later, the app says you owe Rp1.300.000.
Most people look at that and think: steep, but I'll manage.
Here's what it actually is.
You received Rp800.000 and paid back Rp1.300.000, so the loan cost you Rp500.000. Over 30 days. On a Rp1.000.000 contract.
That works out to 1,67% per day.
The legal maximum in Indonesia is 0,3% per day.
This loan is charging more than five times what the law allows. And almost nobody would spot it, because who converts "I owe 1,3 juta in a month" into "percent per day" in their head?
That's the problem I built Perisai to solve.
Some words you'll need (no assumptions)
I'm going to explain every bit of jargon, because the whole point of this project is that jargon is where people get lost.
Pinjol — short for pinjaman online, "online loan." Apps on your phone that lend small amounts fast. Some are legitimate. Many are not.
OJK — Otoritas Jasa Keuangan, Indonesia's financial regulator. The government body that decides what lenders are allowed to do. Think of them as the referee.
Bunga — interest. The extra money you pay for borrowing.
Tenor — how long the loan lasts. Thirty days, six months, a year. This word matters more than any other in this story, and you'll see why.
Galbay — gagal bayar, "failed to pay." The word people use about themselves when they can't repay. It's the word that turned out to be missing from everything I wrote.
DC — debt collector. The person who messages you when you're galbay.
Why can't people just work this out themselves?
Because the maths is genuinely non-obvious, and the reason is tenor.
Look at those two bars. Both loans cost exactly Rp500.000 in charges. The left one is illegal. The right one is completely fine.
The only difference is time. The same Rp500.000 spread over a year is a fair price. Spread over a month, it's a violation.
So when someone says "they charged me 50%," that tells you nothing. Fifty percent over what period? The tenor decides everything, and it's the one thing nobody thinks about when they're just trying to get through the month.
The regulation that sets these limits is called SEOJK 19/SEOJK.06/2025. It's a 28-page PDF from OJK. It has the caps, it has the formula, and it even has two worked examples. Almost nobody has read it. I did, and that turned out to matter a lot later.
What Perisai actually does
Three checks. That's it. No chat window, no AI assistant personality, no "how can I help you today." Just three questions with three answers.
1. Is this lender licensed?
You type the app's name. Perisai checks it against OJK's list of 94 licensed lenders and against the government's blocklist of 594 illegal apps and websites.
2. Is the interest legal?
You type in what you borrowed, what you received, what you owe, and how many days. Perisai does the maths above and compares it to the legal cap.
3. Is the way they're chasing you legal?
You paste a message from a debt collector. Perisai checks it against the rules for what collectors are and aren't allowed to say.
That third one is where the AI comes in. And that's worth explaining properly.
The one rule that shaped everything
Early on I made a decision that turned out to be the most important thing in the project:
Maths and lookups are done by plain code. Understanding words is done by AI. Never mix them.
Why keep the AI away from the maths? Because AI models (I used Google's Gemini) are brilliant at reading and terrible at arithmetic. Ask one to divide 500.000 by 30.000.000 and it'll usually get it right. Usually. But "usually" is not good enough when the answer is "your lender is breaking the law."
A number you can't reproduce is a number you can't trust. So every calculation in Perisai is normal code — the same input gives the same answer, every time, forever.
But the third check can't be done with plain code. A debt collector never writes "I am threatening you." They write "we know where your child goes to school." No keyword search will catch that. A human understands it instantly. So does Gemini. That's the one job where an AI genuinely earns its place.
A quick glossary for that diagram:
- Gemini — Google's AI model. Think of it as the engine that reads and understands language.
- Cloud Run — a computer in Google's data centre that runs my app. I don't own a server; I rent a slice of theirs and pay only when someone uses it.
- Firebase Auth — the "Sign in with Google" button. Handles logins so I never see or store anyone's password.
- Firestore — the database where your saved checks live. Each person's data is locked so only they can read it.
The bug that passed its own test
Here's the part I almost didn't write about.
I built the first version with an AI coding tool. It looked finished. Clean interface, the three checks, even a test suite that reported "all tests passing." I was pleased.
The calculator had never worked once.
The rules file described loan types as "konsumtif" and "produktif" — the Indonesian words. The app asked users for "consumptive" and "productive" — the English words. The code compared them directly. They never matched. So every single calculation quietly fell through to "no legal limit found," for every loan, every time.
And the test? It had been written with the same wrong assumption. So it passed.
What caught it wasn't a better AI or a smarter test. It was two numbers I didn't write. The OJK regulation includes worked examples — an actual loan with actual figures, and the rate the regulator says it should produce. 0,017% for one, 0,007% for the other. I made those the tests.
Code can agree with itself all day. It cannot fake agreeing with a number the regulator published.
That one decision surfaced everything else that was wrong:
- The calculator was dividing by the cash received instead of the contract amount. OJK uses the contract amount. Different denominator, different answer.
- It rounded numbers before comparing them to the cap, so a rate slightly over the limit could round down onto it and report "legal." That's the one direction of error this app must never make.
- A complaint letter — the kind you'd send to OJK — cited a regulation that had been revoked a year earlier.
None of that was visible from the outside. All of it was there.
Five apps pretending to be someone else
This was the last bug, and the sharpest.
When I ran the two government lists against each other, five names appeared on both. Danaku, Mekar, Uangme, Pinjamyuk, Danacita — all real, licensed lenders. And all five also had entries on the blocklist.
That's not a mistake in the data. Look at where the blocklist entries came from: APK mirror sites and lookalike websites. These are fake apps deliberately named after real ones, so when you search for the legitimate lender you install the fake instead. Impersonation is why they were blocked.
And my app? It checked the licensed list first and returned immediately. So if you'd installed a fake DanaKu, been harassed by it, and typed the name into Perisai — Perisai would have shown you the real company's licence number and said "licensed." It would have certified the impersonator using the victim company's credentials.
The fix wasn't to pick a winner. Both records are true. Danaku is licensed. The fake DanaKu is blocked. So now Perisai shows you both, side by side, and tells you the two things that actually settle it: the company name on your contract, and which app store you installed from.
Being careful about what you don't know
One more rule, and it matters as much as the maths.
If you type a lender's name and it's not on the licensed list, Perisai does not say "illegal." It says "not found" — in amber, not red — and lists the innocent reasons that might be true: the company might be registered under a different legal name, it might be a bank supervised under a different licence, you might have a typo, the list might be out of date. Then it sends you to OJK's hotline (157) to check.
Why so cautious? Because this app names real companies. Calling a licensed lender "illegal" because of a typo isn't just unhelpful — it's the kind of thing that gets you sued. So the rule is: never claim more than the data supports. Say what you checked. Say what you found. Don't guess the rest.
What happened next
I posted about it on LinkedIn. No image, no video, just text. I assumed a handful of people would read it.
It reached about 55,000 people in three days, 99% of them outside my network. Sixty of them clicked through and signed in. People I've never met, in cities I've never been to, authenticating with their Google account to use a stranger's app about loan regulation.
Total cost of running it for that first week, including every AI call: about Rp1.900. Roughly eleven US cents.
The best comment came from someone who pointed out that everything I'd written was for people who'd recognise "SEOJK 19/2025." The people who actually need this recognise "DC datang ke rumah jam 11 malam" — the collector's coming to my house at 11pm. Same problem, completely different vocabulary. I'd built the app in the right language and marketed it in the wrong one.
What I'd tell a 15-year-old who wants to build something
Three things.
Pick a problem where being wrong would hurt someone. It forces you to care about correctness in a way that a to-do app never will. Every design decision in Perisai came from asking "what happens if this is wrong?"
Find ground truth you didn't write. My tests passed while my app was broken, because I'd written both. The regulator's worked examples caught it because I couldn't have made them agree by accident. Whatever you build, find a number from outside your system and check against it.
AI is a tool for the part that needs it. Gemini reads threatening messages better than any code I could write. It does arithmetic worse than a calculator from 1985. Knowing which is which is most of the job.
Try it
Perisai: https://perisai-p76rqo7nva-et.a.run.app
Source code: https://github.com/mansoorceksport/perisai
It's free. It's in Bahasa Indonesia and English. Everything it tells you comes from public OJK data, and every result ends with the number for the real humans at OJK who can actually help.
Built for the Google Cloud Gen AI Academy APAC, Cohort 3, with Firebase Auth, Firestore, Gemini on Vertex AI, and Cloud Run.
Perisai is not a lawyer, and neither am I. If you're in trouble with a lender right now: OJK 157, or WhatsApp 081 157 157 157.
#Google #Meetthebuilders #GenAIAcademyAPAC #Cohort3
Top comments (0)