The Cashless Convenience of QRIS
For anyone travelling to Indonesia, from the bustling markets of Jakarta to the serene beaches of Bali, one acronym is impossible to miss: QRIS. This stands for Quick Response Code Indonesian Standard, a unified payment system mandated by Bank Indonesia.
It means that whether you are paying for a coffee, a souvenir, or a taxi, you will likely see a single, standardised QR code. This system allows merchants to accept payments from dozens of different local banking and e-wallet apps through one code, making transactions seamless and fast. For tourists, it promises a world free from the hassle of carrying large amounts of cash or dealing with card machine issues. The system's rapid adoption, especially since 2020, has made it the backbone of the country's retail economy.
How a Simple Scan Can Go Wrong
The primary threat for tourists is a surprisingly simple but effective scam: QR code swapping. Cybersecurity firm Kaspersky has warned that scammers are increasingly targeting the QRIS network by placing a fraudulent QR code sticker over a legitimate one at a merchant's payment counter. An unsuspecting customer scans this fake code, believing they are paying the shop. However, the payment is redirected to the scammer's personal account. By the time the merchant realises they have not received the money, the customer and their funds are long gone. This type of fraud preys on the speed and convenience of the system, as hurried tourists may not pause to verify transaction details. Cases have been reported where even charity boxes at places of worship have had their QR codes replaced by fraudulent ones.
Why Tourists Are Vulnerable
Travellers are prime targets for this kind of fraud for several reasons. They are often less familiar with local payment norms and may not know what a legitimate transaction screen looks like. Distractions in a busy shop, a language barrier, and the rush to complete a purchase can make tourists less likely to scrutinise the payment process. Cybercriminals exploit the fact that travellers are focused on discovering new places, not on cybersecurity. This 'holiday mindset' makes them more susceptible to social engineering and quick decisions. While violent crime against tourists in Indonesia is rare, petty financial scams remain a persistent issue that requires awareness rather than fear.
The UPI-QRIS Connection
Adding to the convenience for Indian travellers is the planned integration of India's Unified Payments Interface (UPI) with Indonesia's QRIS. Advanced discussions are underway to have this linkage operational by the end of 2026, which would allow Indian tourists to scan QRIS codes and pay directly from their Indian bank accounts in rupees. While this development will make transactions even easier, it does not eliminate the fundamental risk of QR code fraud. In fact, the increased simplicity could make users even less likely to pause and verify payment details, making vigilance more important than ever. Until the system is formally launched, Indian travellers should confirm which, if any, of their apps work with QRIS, as a QRIS logo is not a guarantee that any Indian app can pay it.
Your Essential Safety Checklist
Protecting yourself from QR code fraud requires a few moments of attention before you confirm any payment. Following these steps can help ensure your money goes to the right place:
1. Check for Tampering: Before you scan, look at the QR code itself. Does it appear to be a sticker placed on top of another sign? If it looks suspicious or hastily applied, it is best to be cautious.
2. Verify the Merchant Name: This is the most crucial step. After scanning the code, your payment app will display the merchant's registered name. Make sure this name matches the shop you are in. If it shows a personal name or a different business, cancel the transaction immediately.
3. Confirm Payment with the Merchant: Once you have completed the transaction, show the confirmation screen to the cashier and verbally confirm that they have received the payment. All legitimate QRIS transactions result in an instant notification for both the customer and the merchant.
4. Enable Transaction Notifications: Ensure that your banking or payment app is set to send you an immediate alert for every transaction. This helps you spot any unauthorised activity quickly.
5. Use Secure Networks: Avoid making payments while connected to unsecured public Wi-Fi. A Virtual Private Network (VPN) can provide an extra layer of security for your connection.
