Digital payments have made travelling easier than ever, and the new link between India's UPI and Indonesia's QRIS system is a game-changer. But with convenience comes new risks. Here’s what every Indian tourist needs to know before scanning that code.
A New Era of Cashless Travel
For years, Indian travellers heading to Bali, Jakarta, or the Gili Islands had to juggle currency exchange, international card fees, and carrying wads of Indonesian Rupiah. That landscape has now changed dramatically. A recently established partnership allows Indians to use their familiar UPI-based apps, like PhonePe or Google Pay, to make payments across Indonesia. This is possible through the country's unified QRIS (Quick Response Code Indonesian Standard) system. When you see a QRIS code at a shop, restaurant, or even a local market stall, you can now scan it with your Indian payment app to pay directly from your bank account in India. The system automatically handles the currency conversion, offering a seamless and often cheaper alternative to traditional methods. This integration is designed to boost tourism and make life simpler, but it also opens a new door for digital fraudsters.
Understanding the QR Code Scam
The convenience of QR codes is also their biggest vulnerability. The most common scam is deceptively simple: fraudsters place a sticker of their own QR code directly on top of a legitimate merchant's code. An unsuspecting tourist, eager to pay for their coffee or souvenir, scans the code, enters their PIN, and approves the transaction. The payment confirmation screen appears, and everything seems normal. However, the money has been diverted to the scammer's anonymous digital wallet, not the shop owner. By the time the merchant realises they haven't been paid, the tourist is often long gone. This 'sticker-swapping' tactic requires no sophisticated hacking, just a printer and some nerve, making it a widespread nuisance in regions with high QR code adoption.
Other Digital Traps to Avoid
Beyond the physical sticker scam, tourists should be aware of other digital risks. Some malicious QR codes don't initiate a payment but instead direct your phone's browser to a phishing website. This fake site might look like a legitimate payment portal or your bank's login page, designed to trick you into entering sensitive information like your password, card number, or OTP. Once you enter these details, scammers can gain access to your accounts. Another tactic involves QR codes that, when scanned, attempt to download malware onto your device. This is less common but highly dangerous, as the malicious software can quietly steal your data in the background. The core principle for staying safe is to treat every QR code as a digital doorway that needs to be opened with caution.
Your Safety Checklist Before You Pay
Adopting a few simple habits can drastically reduce your risk of falling victim to a QR code scam. Before you approve any payment, run through this mental checklist:
1. Verify the Merchant's Name: After scanning the code, your payment app will display the name of the recipient. Take a second to confirm that this name matches the name of the shop or restaurant you are in. If it shows a personal name or something generic and suspicious, cancel the transaction and ask the merchant.
2. Inspect the QR Code: Look for any signs of tampering. Does the code look like it's on a sticker placed over another one? Are the edges peeling? If anything seems off, point it out to the staff or opt to pay with another method.
3. Trust Your App, Not a Website: A legitimate QRIS payment will happen entirely within your official, trusted payment app. If scanning a code opens a web browser and asks you to log in or enter details, it is almost certainly a scam. Close the window immediately.
4. Confirm Payment with the Merchant: After the transaction is complete, show the confirmation screen to the merchant and wait for them to acknowledge that they have received the funds. Don't be in a rush to leave until both parties are satisfied.
