Indonesia is a top destination for Indian travellers, offering incredible experiences from Bali's beaches to Jakarta's bustle. The convenience of its unified QRIS payment system makes transactions easy, but a new warning highlights a critical risk.
Understanding QRIS: Indonesia’s Payment Revolution
Across
Indonesia, from high-end restaurants in Jakarta to small warungs (local eateries) in Bali, you will find QR codes for payment. Most of these use the Quick Response Code Indonesian Standard, or QRIS. Launched by Bank Indonesia, QRIS is a unified system that allows customers to pay any merchant using a single, standardised code, regardless of which banking or e-wallet app they use, such as GoPay, OVO, or DANA. This innovation has made cashless transactions incredibly simple and widespread, contributing to financial inclusion for millions of small businesses. For tourists, it offers a seamless way to pay without fumbling for cash, and visitors from certain countries may even be able to use their home banking apps.
The Sticker Scam: How Fraudsters Exploit QRIS
The very simplicity that makes QRIS convenient is also what scammers are exploiting. According to a recent alert from cybersecurity firm Kaspersky, fraudsters have identified a low-tech but effective way to steal money. They physically place a sticker with their own fraudulent QR code over a legitimate merchant's code. This can happen at a shop counter, a restaurant table, or even at donation boxes in places of worship. An unsuspecting tourist, intending to pay the merchant, scans the fake code and approves the transaction, inadvertently sending their money directly to the scammer’s account. Because the transaction happens instantly, the theft is often not discovered until much later when the legitimate merchant points out the payment was never received.
Why Tourists Are Prime Targets
Cybercriminals often target travellers precisely because they are out of their usual routine. As Noushin Shabab, a lead security researcher at Kaspersky, notes, 'Travel is a time when people naturally focus on discovering new places, not on cybersecurity'. Tourists are more likely to be using unfamiliar digital services, connecting from new locations, and making quick decisions without the same level of scrutiny they might use at home. This relaxed mindset makes them attractive targets for scams involving everything from fake booking sites to tampered QR codes and unsecured public Wi-Fi networks. The warning specifically highlights the risks for the growing number of Indian tourists visiting Indonesia.
Your 3-Second Check: How to Spot a Fake QR Code
Protecting yourself from this scam doesn't require technical expertise, but it does demand a moment of vigilance before you approve any payment. First, physically inspect the QR code. Does it look like a sticker has been pasted over another code? Is it poorly printed or awkwardly placed? If anything seems suspicious, ask the merchant to confirm it is their official code. The most crucial step happens on your phone screen after you scan. Before you enter your PIN or authorise the payment, your payment app will display the name of the recipient. Take three seconds to verify that this name matches the name of the shop or restaurant you are paying. If the name is a personal name or something completely unrelated, do not proceed with the payment.
Kaspersky’s Safety Checklist for Travellers
Beyond checking QR codes, Kaspersky provides a broader set of recommendations for staying cyber_safe while travelling. Book flights and hotels through official websites rather than clicking on links in unsolicited emails. Be cautious on public Wi_Fi, especially when accessing banking services, and consider using a VPN for an encrypted connection. Use strong, unique passwords for your travel_related accounts and enable multi_factor authentication wherever possible. It is also wise to enable transaction notifications on your banking apps to spot any unauthorised payments immediately. And as a general rule, always carry a mix of payment options, including some cash in the local currency (Indonesian Rupiah) for smaller vendors or as a reliable backup.
