Bulk WhatsApp number check for Indonesian customer lists (+62)

To check a list of Indonesian numbers for WhatsApp, convert every row to E.164 (+628…), remove duplicates, upload the file as a bulk job with the whatsapp check, read the free estimate, and download one answer per number: registered, not registered or unknown. Most mistakes happen before the check: Indonesian lists mix 08…, 628… and 8… formats, and mobile numbers have 9 to 12 digits after +62. Check only numbers your customers gave you, with a lawful basis under Indonesia's Personal Data Protection Law (UU 27/2022), and never use the answers to find new people to message.

This guide covers what is specific to Indonesia. The general flow is in our bulk WhatsApp number check guide. Facts are as of 3 November 2026, and every price below carries its date. This is general guidance, not legal advice.

How do you format Indonesian numbers for a WhatsApp check?

Use the international form, +62 followed by the number without its leading 0. Indonesian exports rarely look like that. In one CRM column you can find five spellings of the same mobile:

The trap is the third row. If you upload a mixed file and tell the job that numbers without + are Indonesian (default_country: "ID"), a cell like 62812XXXXXX is read as a national number: +62 is added in front and it becomes +6262812XXXXXX. libphonenumber accepts that as a valid Indonesian landline, so it isn't rejected as invalid; it is checked as a different number. We confirmed this with libphonenumber-js 1.13.13 on 2026-11-03. The safe rule: convert every row to +62… yourself, then upload.

This converter does that for a mobile list. It handles the five spellings above and returns null for anything that isn't a valid mobile:

import { parsePhoneNumberFromString } from "libphonenumber-js/max";

/** One Indonesian list cell → E.164 mobile (+628…), or null. */
export function toE164Id(raw) {
  const s = String(raw).trim();
  let d = s.replace(/\D/g, "");
  if (!s.startsWith("+")) {
    if (d.startsWith("0062")) d = d.slice(2);            // 0062 8… → 62 8…
    else if (d.startsWith("08")) d = "62" + d.slice(1);  // 08…     → 62 8…
    else if (d.startsWith("8")) d = "62" + d;            // 8… (leading 0 lost in a spreadsheet)
    // 628… (wa.me style, no plus) is already international
  }
  const p = parsePhoneNumberFromString("+" + d);
  return p?.isValid() && p.getType() === "MOBILE" ? p.number : null;
}

We ran it on 2026-11-03 with Node 24 and libphonenumber-js 1.13.13, on libphonenumber's own example numbers. Digits are masked with X here:

The first five rows are the same customer. After conversion they collapse into one E.164 number, which is what makes the duplicate count honest. If your list should hold only Indonesian customers, filter out results that don't start with +62.

Why do Indonesian mobile numbers have different lengths?

Each operator gets a block that starts with 8 and sets the length of the numbers in it. libphonenumber's metadata for Indonesia (region ID) accepts 9 to 12 digits after +62 for mobiles. In our run, every length from 9 to 12 digits in the 081 block was a valid mobile, and 8 or 13 digits were invalid. The mobile blocks are 081–083 and 085–089. 080 and 084 are not mobile, and 0807 is a universal access range (libphonenumber metadata).

Two consequences for a list:

• Don't filter by length. A rule such as "must be 12 digits" deletes valid customers. Validate with the block and the length range, which is what libphonenumber does.
• The prefix still tells you something. We found no mobile number portability in force in Indonesia when we last checked Komdigi's legal database (2026-09-27), so an 08XX block usually still points to the operator it was given to. Treat that as a dated finding, not a guarantee.

How do you check a list of Indonesian numbers on WhatsApp?

Five steps, from export to answers:

1. Export only customers who gave you their number, with your own ID column (for example crm_id,phone). Leave out bought lists, scraped numbers and number ranges.
2. Convert and dedupe. Run every cell through a converter like the one above. Keep the rows that return null aside for a manual fix; don't guess.
3. Estimate. Upload the file in the dashboard (Bulk jobs › Upload a list), or send the numbers to POST /v1/jobs/estimate. The estimate is free, checks nothing and stores nothing.
4. Run with a cost cap. Start the job with max_cost set to the estimate, so it can never cost more. Choose whatsapp, or whatsapp.business if you also need to know whether the account is a WhatsApp Business account.
5. Download and join back. The result file keeps your row order and IDs. Store each answer with its checked_at date.

A job holds up to 50,000 numbers, and a dashboard file can be up to 10 MB. Bigger exports go into several jobs.

What does the estimate tell you?

Here is a real estimate made with the public sandbox key on 2026-11-03. The sandbox accepts only our test values, which are UK drama-range numbers, so this shows the shape of the answer, not Indonesian data. One number is sent twice in two spellings:

curl https://api.mobilevalidate.com/v1/jobs/estimate \
  -H "Authorization: Bearer mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+44 7700 900001", "+447700900002", "+447700900003", "+447700900006"],
       "checks": ["whatsapp"]}'

Response (abridged):

{
  "object": "estimate",
  "total": 5,
  "valid": 4,
  "invalid": 0,
  "duplicate": 1,
  "checks": ["whatsapp.registered"],
  "max_cost": { "amount": "0", "currency": "USD" },
  "breakdown": [
    { "check": "whatsapp.registered", "price_mode": "batch", "reason": null, "checks": 0,
      "unit_price": { "amount": "0.00025", "currency": "USD" } },
    { "check": "whatsapp.registered", "price_mode": "realtime", "reason": "small_batch", "checks": 4,
      "unit_price": { "amount": "0.004", "currency": "USD" },
      "countries": ["GB"], "batch_minimum": 132 }
  ]
}

Read three things. duplicate: 1 is the second spelling of the same number, which is never checked or billed. max_cost is 0 because test keys are never billed. And the small_batch line: the bulk price needs at least 132 numbers from the same country in one job. Four numbers are below that minimum per country group, so they would be checked the real-time way at the real-time price. For an Indonesian list this rarely matters for the Indonesian rows, but it does for the handful of +60 or +65 customers in the same file. The estimate shows them on their own line before you spend anything. Details are in the bulk jobs docs.

What does it cost?

From our public catalog (GET /v1/services), fetched on 2026-11-03:

Only conclusive answers are billed. Unknown, invalid, duplicate and unsupported rows are free, and so are repeats served from your account's cache. Prices can change; the pricing page always has the current ones.

A worked example with made-up figures, to show the arithmetic: a 20,000-row export converts to 18,500 unique valid Indonesian mobiles. The WhatsApp job can cost at most 18,500 × US$0.00025 = US$4.63. If 3,000 of them come back not registered and you want to know which of those still work before you send SMS, an HLR job on those 3,000 costs at most 3,000 × US$0.005 = US$15.00.

What share of Indonesian numbers are on WhatsApp?

We don't quote one, and you shouldn't plan with one. Public reports give a country-level picture, not an answer for your list. DataReportal's Digital 2026 report for Indonesia counts 331 million cellular mobile connections at the end of 2025, equal to 116% of the population, 230 million internet users (80.5%) and 180 million social media user identities (62.9%) (DataReportal, 2026).

The first number matters most for a list. More connections than people means many customers hold a second SIM, for work, data or a cheaper tariff, and every prepaid SIM must be registered to an identity under Komdigi Regulation 7 of 2026 (Permenkomdigi 7/2026). The number a customer typed into your form may not be the one their WhatsApp account sits on. That is why a check of your own list beats any national average: it measures your customers, number by number.

Is WhatsApp cheaper than SMS for OTP in Indonesia?

At list prices, yes, by a wide margin. Of the six markets in our OTP cost comparison, Indonesia had the most expensive SMS:

The authentication-international rate is the cross-border rule to know. Meta charges it when three things hold: your business is eligible, it is based in another country than the recipient, and the message was delivered after your start time. A business becomes eligible once it sends more than 750,000 messages outside customer service windows in a moving 30-day period to users in markets with such a rate, and it gets 30 days' notice. Meta's own example is Indonesia: a business based in Indonesia sending codes to +62 users pays the normal rate, a business based in India pays the international one (Meta, 2026). Indonesia has had that rate since 1 June 2024.

Two more facts help the comparison. Meta charges only for delivered messages (Meta pricing), so a code sent to a number without WhatsApp costs nothing but time. And negotiated SMS rates can be far below list prices, so use your own invoice. Our WhatsApp OTP vs SMS OTP cost guide has the formula for cost per verified user. A pre-check fits in front of it: at US$4.00 per 1,000 in real time, checking a number costs a small fraction of the gap between one WhatsApp code and one SMS to Indonesia.

What does Indonesia's PDP Law require before you check or message?

Indonesia's Personal Data Protection Law, Law No. 27 of 2022 (UU PDP), was enacted on 17 October 2022 and gave controllers two years to comply (article 74), so it fully applies since October 2024. We read the text in Komdigi's legal database on 2026-11-03 (UU 27/2022). The points that touch a number check:

• A customer's number is personal data. Article 1 defines personal data as data about an identified or identifiable person, alone or combined with other information. A mobile number in your CRM, next to a name and an order history, qualifies.
• It reaches beyond Indonesia. Article 2 applies the law to processing outside Indonesia that has legal effect in Indonesia or on Indonesian citizens abroad. A company in Singapore or Europe checking Indonesian customers is covered.
• You need a lawful basis. Article 20 lists six: explicit consent for stated purposes, performance of a contract with the person, a legal obligation, vital interests, a public task, and legitimate interests balanced against the person's rights. Choose and record yours before you upload.
• If the basis is consent, prove it. Consent must be written or recorded, electronic or not (article 22), and the controller must be able to show it (article 24). Before relying on consent, you must tell people the purpose, the data, the retention period and their rights (article 21).
• Stay within the purpose and keep data accurate. Processing must match the purpose (article 28), and the controller must ensure the data is accurate, complete and consistent (article 29). Checking which channel reaches a customer who expects to hear from you fits that duty. Checking numbers to build an audience you have no relationship with does not.
• Withdrawal stops processing fast. When someone withdraws consent, processing must stop within 3 × 24 hours (article 40), and data must be deleted when it is no longer needed or was obtained unlawfully (article 43).
• Processors and transfers. A checking service acts as your processor, on your instructions (article 51). Sending data to a processor outside Indonesia needs an equivalent level of protection, adequate binding safeguards, or the person's consent (article 56). That is what a data processing agreement is for.
• Sanctions are real. Administrative fines go up to 2% of annual revenue (article 57). Unlawfully obtaining or collecting someone else's personal data for gain, in a way that can harm them, is a crime (article 65), punishable by up to five years in prison and/or a fine of up to Rp5 billion (article 67). Bought and scraped lists sit close to that line.

The JDIH entry listed no implementing regulations for the law when we read it, and the law leaves the oversight agency and parts of the sanctions procedure to later presidential and government regulations. Ask Indonesian counsel how the current rules apply to you.

WhatsApp's own rules sit on top of the law. Its Business Messaging Policy (last updated 23 September 2026) says you may only contact people on WhatsApp if they have given you their number and you have received "opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you" (WhatsApp, 2026). Meta's opt-in guide adds that the opt-in must clearly name your business and that you must comply with applicable law (Meta for Developers, 2026). A registered: true answer is a fact about the number, not permission to message it. Our consent and law guide covers other regions.

On our side, a request with long runs of consecutive numbers is refused as suspected enumeration, each account has a daily cap, and our acceptable use policy forbids unsolicited bulk messaging and checking ranges to find out who uses an app. Anyone can object through the opt-out form.

What do you do with numbers that are not on WhatsApp?

Route them to a channel that reaches them, and keep the answer:

For the not-registered group, an HLR check answers the next question: is the number reachable on its network at all? An unreachable answer on an old number is a reason to confirm it with the customer before you pay for SMS to it. Treat unknown as missing data, never as a dead number, and don't overwrite a stored conclusive answer with an unknown one. Our list cleaning guide shows how to combine the checks.

Re-check before each campaign to opted-in customers, starting with the oldest answers. Numbers do change hands: a number that is given up is later assigned to someone else, so a list from two years ago has drifted.

How do you start with MobileValidate?

The checks for this guide are WhatsApp number check, WhatsApp Business check and live network status (HLR). All three take Indonesian numbers in real time and in bulk jobs. You don't need a WhatsApp account, a phone or a QR pairing.

• Free, today. Get a free test key to build against fixed test answers, and use the free estimate on any file before you pay.
• Five real checks free. Every live account gets 5 real phone checks and 5 real e-mail checks on the dashboard's Try it page. Request access to open one.
• Then prepay. Top-ups of US$100 or more get a 5% bonus, US$500 or more 8%, and US$2,000 or more 10%.

Results are kept for your account's retention setting, 30 days by default, and you can delete a job's results at any time. WhatsApp is named descriptively; MobileValidate is not affiliated with WhatsApp or Meta.

What are the key takeaways?

• Convert every row to +62… before upload. 08…, 628…, 0062… and 8… are the same customer, and mixing them with a default country can silently create a wrong number.
• Indonesian mobiles have 9 to 12 digits after +62. Never filter by one length.
• Bulk WhatsApp checks cost US$0.25 per 1,000 (catalog, 2026-11-03), with a minimum of 132 numbers per country group in one job for the bulk price. Unknowns and duplicates are free.
• A WhatsApp authentication message to Indonesia lists at US$0.0250, against SMS list prices from US$0.3333. Foreign senders above Meta's threshold pay US$0.1360.
• Under UU 27/2022 you need a lawful basis, the purpose must match, and a withdrawal stops processing within 3 × 24 hours. Check your own customers' numbers, never bought or scraped lists.