This study examines how the Indonesian government protected Indonesian citizens affected by Cambodia’s online scam industry between 2020 and 2024, with particular attention to individuals identified or documented as victims of trafficking in persons, and evaluates gaps between formal protection mandates and documented outcomes. It employs a descriptive qualitative case study and documentary analysis of 31 government, embassy, international organization, NGO, academic, and media documents. The documentary record shows that Indonesian authorities handled a substantially larger population of citizens associated with online scam cases than those formally identified as trafficking victims; these categories are therefore treated separately throughout the analysis. State protection is most clearly documented at the rescue, consular assistance, victim-identification, referral, and repatriation stages, while post-return rehabilitation, economic recovery, and long-term monitoring remain less systematically documented. The findings also show that transnational syndicates exploit digital recruitment, tourist-visa travel, indirect transit routes, debt, document confiscation, confinement, and physical, psychological, and financial coercion. Three recurring implementation gaps are identified: a temporal gap between the escalation of cases and institutional responses, a coverage gap affecting citizens who move through non-procedural migration channels, and a capacity-related gap between broad protection mandates and the publicly documented institutional resources available for implementation. The study contributes by adapting personal security analysis to the role of a migrant-origin state and by emphasizing protection continuity from prevention and identification to rescue, repatriation, and reintegration.