ligaklik Account Opening Flow
Account opening on ligaklik follows a three-stage process: email registration, KYC (Know Your Customer) document upload, and payment method linking. The email address becomes your login credential; we send a verification link to confirm ownership. Next, we request a government-issued ID (Indonesian KTP, passport, or regional equivalent) and a proof of address (utility bill, bank statement, or official correspondence within three months). This step typically completes within hours but may take up to one business day during high-volume periods.
Once KYC is approved, you link a payment method. On ligaklik, we support DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, and e-wallet. E-wallets (mobile banking, local payment, online payment, e-wallet, mobile banking) connect via your phone number and existing account balance. Bank transfers and local payment require either a virtual account number or a one-time transfer confirmation. We do not store payment credentials directly; instead, we receive a tokenized reference that your bank or e-wallet provider manages.
After linking a payment method, your account transitions to "active" status. You can then browse Liga 1, Piala AFF, Champions League markets, live-dealer tables (blackjack, roulette, baccarat, Dragon Tiger), and slot games (Aviator, Sweet Bonanza, Gates of Olympus, Fortune Tiger, Mahjong Ways). All subsequent actions—deposits, withdrawals, game participation—are tied to this verified account identity.
Password and Login Security on ligaklik
We require a password of at least 12 characters, combining uppercase, lowercase, numbers, and symbols. This rule enforces entropy and reduces brute-force attack surface. We hash passwords using bcrypt with a cost factor of 12, meaning even if our database were compromised, attackers would face hours or days of computation per password attempt.
Optional multi-factor authentication (MFA) adds a second verification layer. When enabled, after entering your password, ligaklik sends a time-based one-time password (TOTP) code to your registered mobile phone via SMS or a third-party authenticator app. We recommend MFA, particularly if your account will hold deposits or frequent withdrawals during major football events (Liga 1 season, Piala AFF, Champions League knockout stages, Idul Fitri, Idul Adha).
We monitor login attempts for anomalies: logins from new IP addresses, logins at unusual hours, or rapid successive failures trigger a review. If we detect suspicious activity, we may temporarily lock the account and send you a notification email. You can unlock by confirming the login from a link in that email or by contacting our support team.
Deposit and Withdrawal Verification on ligaklik
Every deposit and withdrawal on ligaklik triggers a verification check. For deposits, we cross-reference the sending account (your linked online payment, e-wallet, mobile banking, etc.) with your registered name and ID number. If the names do not match, we may reject the deposit or place it in a review queue. This typically resolves within one to two hours once you provide clarification.
Withdrawals follow a similar pattern. You specify an amount and a destination payment method. We verify that the destination account is registered to your verified name and ID. If you attempt to withdraw to an account under a different name, we block the request and notify you to correct the destination. This friction exists because it is the strongest protection against account compromise: even if someone gains your password, they cannot redirect funds to an account we do not recognize as yours.
Verification is not a delay—it is the boundary between a secure account and a compromised one. We prioritize correctness over speed.
Processing windows vary by method. local payment and online payment typically settle within minutes. e-wallet transfers depend on your bank but generally complete within one to four hours on business days. mobile banking, local payment, online payment, and e-wallet virtual accounts may take up to 24 hours to reflect in your account during high-volume periods (such as around Idul Fitri or major Liga 1 playoff matches). We provide a transaction ID immediately upon submission so you can track status in your linked bank app or e-wallet.
Fraud Detection and Account Recovery
We employ real-time transaction scoring: each deposit, bet placement, and withdrawal is assigned a risk score based on historical patterns, velocity, location, and device fingerprint. High-risk actions trigger manual review or a phone confirmation step. We do not block legitimate activity; instead, we surface it for human verification.
If your account is compromised—for example, someone logs in from an unknown location and attempts large withdrawals—our system typically locks the account within minutes. We send you an email and SMS alert. To regain access, you must confirm your identity through a secure link sent to your registered email or by calling our support hotline with your full name, ID number, and the last four digits of your registered payment method.
-
1
Detect anomalyReal-time scoring
Our system flags high-risk actions: unusual login location, rapid withdrawals, device changes.
-
2
Lock accountImmediate action
Account transitions to a locked state; no withdrawals or bets are processed.
-
3
Notify userEmail + SMS alert
We send you a security alert with a link to confirm your identity or contact support.
-
4
Verify identitySecure link or call
You confirm via email link or phone call; once verified, account access is restored.
If we cannot reach you via email or phone, we hold the account in locked state for up to 30 days. This prevents attackers from draining your balance while waiting for verification. Once you contact us, we complete identity checks (typically asking for your ID and recent statement) and unlock within one business day.
Payment Method Security and Binding
On ligaklik, each payment method is bound to your verified account. You cannot deposit to your ligaklik account via someone else's mobile banking or local payment—our verification rejects mismatches between the payment account holder and your registered name.
You may add multiple payment methods (e.g., both online payment and e-wallet), but each must pass verification. If you change your phone number and wish to use a different SIM card with the same e-wallet, you must update your profile on ligaklik and re-bind the payment method. We do this to prevent account takeover scenarios where an attacker swaps payment details without your knowledge.
Bank virtual accounts (mobile banking, local payment, online payment, e-wallet, mobile banking) are issued uniquely per ligaklik account. Each VA number is tied to your account ID; deposits to that VA are automatically credited to your ligaklik balance. Withdrawals from ligaklik are sent back to the same registered bank account you used for deposits, creating a closed loop.
- Token vs. Credential
- We store a token (reference code) from your bank or e-wallet provider, not your actual password or card number. Tokens expire and can be revoked independently of your ligaklik account.
- Account Linking
- Linking a payment method requires you to authorize on your bank's or e-wallet's app. We never see your password; the provider confirms your consent and issues a token.
- Unlink & Re-link
- You may unlink a payment method from your ligaklik settings at any time. Re-linking requires a fresh authorization on the payment provider's side.
Encryption and Data Storage
All data transmitted between your device and ligaklik servers travels via TLS 1.3 encryption. This means traffic is encrypted end-to-end; even if captured on a public Wi-Fi network, it cannot be read without the decryption key held only by our servers.
Stored data is encrypted at rest using AES-256. Your password is not stored plaintext; it is hashed with bcrypt. Your ID number and address are encrypted and stored separately from your payment tokens. If our database were breached, an attacker would find hashed passwords (useless without massive computation) and encrypted personal data (useless without the encryption key, which is held off-database).
We do not sell or share your personal data with third parties. Our payment processors (local payment, online payment, e-wallet, etc.) receive only the information they need to process your transaction: your name, ID, amount, and destination account. We retain transaction records for tax and regulatory compliance, stored securely and accessible only to authorized personnel.
