Indonesia, especially Bali, is a dream destination for many Indian travellers. Amidst the excitement of planning your trip, it's crucial to be aware of a rising issue: QR code payment fraud that can catch even savvy tourists off guard.
The Convenience and the Catch
Across Indonesia,
from bustling Jakarta markets to serene Bali cafes, you'll find QR codes for payment everywhere. This system, known as QRIS (Quick Response Code Indonesian Standard), unifies various digital wallets and mobile banking apps into one seamless payment method. It’s incredibly convenient, allowing for cashless transactions for everything from street food to souvenirs. However, this very simplicity has been exploited by scammers. Cybersecurity firm Kaspersky has recently highlighted these scams as a key risk for tourists, including the large number of Indian travellers visiting the country.
How the Scam Works
The most common method is deceptively simple: fraudsters place a sticker with their own fraudulent QR code directly over a legitimate merchant's code. This can happen at restaurants, parking lots, donation boxes at places of worship, and with street vendors. When you scan the doctored code, your payment app displays the scammer's account details, not the merchant's. Unaware, you approve the transaction, and your money is sent directly to the fraudster. Another tactic, known as 'quishing' (QR code phishing), involves a QR code that directs you to a fake website designed to steal your personal data, login credentials, or financial information.
The Number One Rule: Always Verify the Merchant
The single most important step to protect yourself is to pay attention to your phone screen after scanning a code. Before you enter your PIN or authorise the payment, your payment app will display the name of the merchant receiving the money. If you are at 'Babi Guling Sari Dewi' but your app shows a payment to 'Toko Berkah Jaya' or a personal name, stop the transaction immediately. This three-second check is your most effective defence. Alert the merchant if you notice a discrepancy, as their legitimate code may have been tampered with.
Red Flags to Watch For
Developing a cautious eye can help you spot potential scams before you even scan. Be wary of QR codes that look like they've been pasted on as a sticker, especially if they look worn, poorly printed, or placed awkwardly over another code. Legitimate QRIS displays from merchants are often professionally printed on acrylic stands or are laminated. Also, be suspicious if a QR code prompts you to enter sensitive information like a password or directs you to download an application; official QRIS payments do not require this. Only scan codes using official payment apps from banks or e_wallets, not your phone's general camera app.
What to Do If You Suspect You've Been Scammed
If you realise you've paid the wrong account or have been a victim of fraud, act quickly. First, contact your bank or digital wallet provider immediately to report the fraudulent transaction and request a block on your account or card if necessary. Then, if possible, file a report with the local police (Polri). You can dial the emergency line 110. It's also advisable to inform the merchant, as they are also a victim in this scenario. Keep records of all transactions, screenshots, and any communication, as this will be essential for any investigation or dispute process.
