The three blasts all occurred within 10 minutes of each other, police said, with the first explosion at 7:30 am (0030 GMT).
"In total 13 people are being treated at the hospital".
The primary assault was on the Santa Maria Roman Catholic Church, which killed two individuals, together with a suspected suicide bomber disguised as a churchgoer, and wounded 11, police advised TVOne community.
At least one of the attackers was killed when they detonated their bomb at Santa Maria.
The bombs failed to explode.
Meanwhile, at least 40 injured victims have been taken to several hospitals in the city, including Soetomo Hospital and Bhayangkara Ngagel Hospital.
Police ordered the temporary closure of all churches in Surabaya on Sunday, and a large food festival in the city was cancelled. Frans later said that the bombings were suicide attacks.
But recent years have seen a number of attacks claimed by Islamic State (IS). In recent years the country has faced a new threat as the rise of the Islamic State group in the Middle East invigorated local militant networks.
Earlier, media reports said a woman with a younger child and a teenager had just entered one church and was being questioned by security when the bomb exploded.
"I heard two explosions, one was in the church's parking lot and the other was outside the church".
The police have yet to confirm Johanes' statement. It was nOt clear if the shootings were connected with the church attacks. Diponegoro, Surabaya, East Java, on Sunday. "Soon after that the explosion happened".
Police on Sunday said four suspected members of the radical group Jamaah Anshar Daulah had been killed in a shootout during raids linked to the prison riot, but would not comment on whether the group was connected to Sunday's bombings.