Cashless payments have made travel in Indonesia incredibly convenient. But a growing cybersecurity threat targeting the country's QR code system requires a moment of caution from tourists before they scan and pay.
The Rise of Cashless Convenience
Across Indonesia, from bustling Jakarta
cafes to serene Bali warungs, the QRIS (Quick Response Code Indonesian Standard) has become the go-to payment method. This unified system allows anyone with a compatible mobile banking or e-wallet app to make instant payments by simply scanning a code. For travellers, it offers a seamless way to pay without fumbling for cash or worrying about card skimmers. Its widespread adoption, however, has also made it a prime target for fraudsters looking to exploit the trust users place in this simple technology.
How the QR Code Scam Works
The scam is deceptive in its simplicity. Fraudsters print their own QR code on a sticker and physically place it over a legitimate merchant's official QRIS code. This is often done in busy environments where staff might not notice the tampering, such as at street food stalls, small shops, or even on donation boxes at places of worship. When an unsuspecting tourist scans the fake code, their payment app opens a confirmation screen. The crucial difference is that the recipient account is not the merchant's but one belonging to the scammer. The tourist approves the payment, thinking they've paid for their meal or goods, but the money is diverted directly to the criminal. The merchant never receives the funds, and the tourist is left out of pocket.
Red Flags: What to Look For
Protecting yourself starts with knowing the warning signs. Before you even scan, inspect the physical QR code itself. Does it look like a sticker has been placed on top of another sign or acrylic stand? Does it look newer or of a different quality than the signage around it? Peeling edges or a crooked placement are major red flags. This simple act of tampering is the scammer's entry point. Another form of this scam, known as 'quishing' (QR phishing), involves codes that direct you to a fake website to steal your login or card details. Your phone's camera app will often show a preview of the website URL before opening it—if it looks suspicious or misspelled, do not proceed.
The Most Important Step: Verify the Merchant
The single most effective way to prevent this fraud is to pause and verify the merchant's name before you confirm the payment. After scanning the code, your payment app will display the name of the recipient account. Take a second to confirm that this name matches the name of the shop, restaurant, or service you are paying. If the name displayed is a personal name, a strange string of characters, or an entity that doesn't match the business (e.g., 'Mosque Restoration' instead of the specific mosque's official name), it is a huge red flag. Do not approve the transaction. If you have any doubt, ask the cashier or staff to confirm their registered QRIS merchant name. A legitimate business will have no problem verifying this for you.
Additional Tips for Safe Payments
Beyond verifying the merchant name, there are other habits that can keep your money safe. Only scan QRIS codes using official mobile banking or e_wallet apps, not your phone’s generic camera app. Legitimate payment apps have security features to detect some fraudulent codes. For larger purchases or at more established retailers, consider using a credit card with tap_to_pay functionality or inserting your card into a terminal. At places where you feel unsure, or if the QR code looks tampered with, simply using cash is a foolproof alternative. Always enable transaction notifications for your bank and payment apps so you are immediately alerted to any suspicious activity.
