Indonesia’s unified QR code system, QRIS, has made payments seamless for locals and travellers alike. But its convenience has also opened the door for scammers, who are increasingly targeting tourists with simple yet effective fraud tactics.
What is QRIS and Why Is It Everywhere?
QRIS, which
stands for Quick Response Code Indonesian Standard, is a national payment system launched by Bank Indonesia. Before its introduction, Indonesia's digital payment landscape was fragmented, with different e-wallets and banking apps like GoPay, OVO, and Dana each using their own proprietary QR codes. This meant a small restaurant or shop owner needed to display multiple codes to accept various payment types. QRIS unified all of them into a single, standardized code. A merchant now only needs to display one QRIS code, and customers can scan it using any registered Indonesian payment app. This simplicity has led to massive adoption, with over 32 million registered merchants and nearly 60 million users. For travellers, it offers the convenience of going cashless at everything from high-end spas in Seminyak to small 'warung' food stalls in Ubud.
The Sticker Scam: How Fraudsters Divert Your Payment
The most common scam targeting travellers is deceptively simple and effective. Fraudsters print a sticker with their own QRIS code, which is linked to their personal or a fraudulent account. They then visit busy merchant locations—such as cafes, street food stalls, parking lots, or even donation boxes in mosques—and physically place their fake sticker directly over the legitimate one. Because the fake sticker can look nearly identical to the real one, it’s difficult to spot at a glance. When a customer scans the compromised code to pay for their meal or service, their payment app reads the scammer's code. Unknowingly, the traveller approves the transaction, and the money is sent directly to the fraudster’s account instead of the merchant's. The scam is often only discovered later when the merchant realizes they never received the payment.
Quishing: The Phishing Scam with a QR Code Twist
Another, more sophisticated threat is 'quishing', or QR phishing. In this scenario, a fraudulent QR code doesn’t lead to a payment screen but instead directs the user to a malicious website. These websites are often designed to look like an official payment gateway, a bank login page, or a special offer page. Victims are prompted to enter sensitive information such as usernames, passwords, card details, or one-time passwords (OTPs). Once this information is entered, scammers can use it to gain access to the victim's bank accounts or other personal data. These malicious QR codes can be distributed via stickers in public places or sent through messages on social media, disguised as a necessary step for a booking or a special deal.
How to Protect Yourself: A Traveller's Checklist
While these scams are a real risk, a few simple checks can help you stay safe. Cybersecurity experts and Bank Indonesia recommend building a habit of verification before confirming any payment. First, always check for physical tampering. Look closely at the QR code stand or sticker. If it looks like a sticker has been pasted over another, or if the sign looks flimsy or out of place, be cautious and consider paying with cash. Second, and most importantly, verify the merchant's name. After you scan the code, your payment app will display the name of the recipient before you enter your PIN to confirm. Make sure this name matches the name of the shop or restaurant you are at. If the name is a personal name or something generic and unrelated like 'Mosque Restoration' instead of 'Masjid Nurul Iman', cancel the transaction immediately. Finally, only use official payment apps downloaded from legitimate app stores and ensure your transaction notifications are turned on to spot any unauthorized payments quickly.
What to Do If You Become a Victim
If you suspect you have paid a fraudulent QR code or entered details on a quishing site, you should act immediately. The first step is to contact your bank or e_wallet provider to report the suspicious transaction and ask them to block your card or account if necessary. The sooner you report it, the higher the chance of potentially recovering the funds or preventing further losses. You should also report the incident to the local authorities. While it may be difficult to resolve as a tourist, reporting helps authorities track these scams and potentially take action against the perpetrators. After returning from your trip, continue to monitor your bank and card statements closely for any unrecognised charges.
