The situation
A taxpayer receives a message claiming there is an urgent Coretax account problem and is told to log in through a link to avoid disruption. The page looks plausible, so the taxpayer is tempted to act first and verify later.
What matters first
DJP's January 2026 warning says official Coretax access is only through coretaxdjp.pajak.go.id. The Coretax portal page on pajak.go.id points users to the same address. That means the taxpayer's first task is not typing credentials. It is verifying that the route into the system is genuine.
Why this is a tax problem, not just an IT problem
In a platform-based tax system, compromised credentials can affect access, filings and data integrity. The taxpayer who gives login details to a fake site is not just suffering an abstract cybersecurity loss. The taxpayer may also be creating direct compliance risk at the same time. That is why DJP's domain warning belongs inside practical tax workflow guidance.
What the next step should look like
The taxpayer should ignore unverified links, start from pajak.go.id or type the official Coretax domain directly, and keep official support channels separate from message-based pressure tactics. The deeper lesson is that secure access habits are now part of normal Indonesian tax administration.
Action checklist
- 1Treat `coretaxdjp.pajak.go.id` as the only official login destination.
- 2Do not follow Coretax login links from unsolicited messages.
- 3Use pajak.go.id as the verification starting point if there is doubt.
- 4Handle credential security as part of ongoing compliance control, not as a one-off IT concern.
Educational content only
This scenario is for general education, not personalized tax advice. Confirm specifics with a qualified professional before acting.