The convenience of QRIS payments across Indonesia is undeniable, but a recent warning from cybersecurity firm Kaspersky highlights a growing risk. Scammers are targeting users with misleading payment codes, especially in busy tourist areas.
Understanding the QRIS Phenomenon
The Quick Response
Code Indonesian Standard, or QRIS, has revolutionized daily commerce in Indonesia. Launched by Bank Indonesia in 2019, it created a single, unified QR code system that all digital payment apps must support. This interoperability means a small food stall (warung) or a large hotel can display just one code to accept payments from dozens of different e-wallets and mobile banking apps. This simplicity has led to massive adoption, with millions of merchants, from street vendors to major retailers, now relying on the system. For locals and tourists alike, it offers a fast, cashless way to pay for almost anything, which is why it has become so widespread, particularly in tourism-dependent regions like Bali.
The Sticker-Swapping Scam Explained
The primary fraud method Kaspersky warns about is deceptively simple and physical. Scammers print their own QRIS code, which is linked to their personal account. They then visit a legitimate business—like a cafe, restaurant, or shop—and place their fraudulent sticker directly on top of the merchant's real QR code. To a customer, the code looks perfectly normal. When they scan it to pay for their meal or purchase, their payment app reads the scammer's code, and the money is sent to the fraudster's account instead of the business's. This tactic is especially effective in busy tourist destinations where customers and cashiers are often distracted, and transactions happen quickly.
Why Tourist Hotspots Are Prime Targets
Cybercriminals focus on tourist areas for several reasons. Tourists are often less familiar with local payment norms and may be more rushed or distracted, making them less likely to notice small discrepancies. They use unfamiliar digital services and connect from new locations, which makes them attractive targets. Locations with high volumes of small transactions, such as cafes, parking lots, and even charity donation boxes in places of worship, are frequently targeted because individual fraudulent transactions are less likely to raise immediate suspicion. The fast-paced environment allows scammers to exploit the moments of trust and convenience that QRIS is designed to create, turning the system's greatest strength into a vulnerability.
How to Spot a Fraudulent QR Code
Vigilance is your best defense. Before you confirm any payment, get into the habit of checking the details on your phone screen. The most critical step is to verify the merchant's name. When you scan a QRIS code, your payment app will display the name of the registered recipient. If the name shown on your screen does not match the name of the shop or restaurant you are at, it is a major red flag. Also, physically inspect the QR code itself. If it looks like a sticker has been placed over another code, if it is blurry, or if it appears tampered with, do not scan it. Official QRIS displays are typically printed on sturdy materials like acrylic, not flimsy paper stickers.
Key Steps to Secure Your Transactions
To stay safe, always follow a simple verification routine. First, after scanning, always doublecheck that the merchant name on your app's confirmation screen is correct before entering your PIN. Second, never rely on a screenshot of a payment from someone else as proof; always verify that the funds have arrived in your own system if you are a merchant. Third, only scan QRIS codes using official mobile banking or e wallet applications, not your phone's general camera app, as official apps have security features to detect invalid codes. Finally, enable real time transaction notifications on your phone. This ensures you are immediately alerted to any payment leaving your account, allowing you to spot unauthorized activity quickly.
