Indonesia remains a top destination for travellers, but as digital convenience grows, so do the risks. Cybersecurity experts are urging visitors to be vigilant against a new wave of scams targeting tourists. Here's what you need to know.
The Tampered QR Code Threat
One of the most
significant risks for travellers in Indonesia involves the national QR payment system, QRIS. This system is widely used in shops, restaurants, and by local vendors, offering a convenient way to pay. However, scammers are exploiting this trust by physically tampering with legitimate merchant QR codes. They place a sticker with their own fraudulent code directly over the real one. When a tourist scans this fake code, they might be redirected to a malicious website designed to steal their financial information or unwittingly send their payment directly into the scammer's account instead of the merchant's. This tactic is particularly effective because tourists are often in a hurry, may be distracted, and are unfamiliar with the local payment processes, making them attractive targets.
How to Spot a Fake QR Code
Before you scan any QR code for payment, take a moment to inspect it. Look for physical signs of tampering. A sticker placed over an existing code, even if it looks professional, is a major red flag. Legitimate businesses can update their payment details digitally without needing to paste a new code on top. Also, check for uneven edges, flimsy paper, or fresh adhesive residue. After scanning, most smartphones preview the URL or payment destination before you proceed. Scrutinise this information carefully. If the merchant's name looks wrong, is misspelled, or the URL seems unrelated to the business, do not proceed with the payment. When in doubt, ask an employee to verify the code is legitimate or opt to pay with a physical card or cash.
Phishing Scams and Fake Bookings
Beyond QR codes, travellers are also warned about a high volume of general web threats, including phishing attacks and fraudulent booking websites. Phishing attempts often come through unsolicited emails, SMS, or social media messages containing links to what appear to be flight confirmations, hotel deals, or tour packages. These links lead to fake websites designed to steal your login credentials or personal data. Similarly, scammers create convincing imitation websites for visa applications, hotels, and tour operators. These sites may appear high in search engine results and use official-looking branding, but charge exorbitant fees for services that are never delivered or for fake documents. In some cases, travellers only discover they've been scammed upon arrival at the airport or hotel.
Your Digital Safety Checklist for Indonesia
Staying safe online while travelling doesn't require being a cybersecurity expert, just being cautious. First, always book flights, accommodation, and tours directly through official company websites or highly reputable booking platforms. Avoid clicking on links in unexpected emails or messages. For visa applications, use the official government portal and be wary of sites demanding payment in foreign currencies like USD, as official Indonesian government payments are processed in Rupiah (IDR). Enable multi-factor authentication on your important accounts, especially for banking and email. When using public Wi-Fi in cafes or hotels, use a Virtual Private Network (VPN) to encrypt your internet connection and protect your data from being monitored. Finally, always doublecheck the URL before entering payment details and keep transaction notifications on for your bank accounts to quickly spot any unauthorised charges.
