Planning a trip to Indonesia? As digital payments become second nature, cybersecurity firm Kaspersky has issued a crucial warning for Indian tourists about the growing threat of fake QR code payment scams.
A Familiar Habit, A New Risk
For Indian travellers, using a phone to scan a QR
code is as common as paying with cash. The convenience of UPI has transformed daily transactions at home, making QR payments a familiar habit. However, this familiarity can lead to a drop in vigilance when travelling abroad. Kaspersky's recent alert highlights that cybercriminals in Indonesia are exploiting this by targeting the country's own national QR payment system, QRIS (Quick Response Code Indonesian Standard). Tourists, often distracted and in a hurry, are prime targets for these scams. As Lead Security Researcher Noushin Shabab from Kaspersky's Global Research and Analysis Team (GReAT) notes, 'Travel is a time when people naturally focus on discovering new places, not on cybersecurity. This is exactly what makes tourists attractive targets'.
How the QR Code Scam Works
The scam is deceptive in its simplicity. Fraudsters physically place a sticker with a fake QR code over a legitimate one at a merchant's payment point, such as a restaurant, shop, or even a donation box. When a customer scans the fraudulent code, their payment app is directed to the scammer’s account instead of the merchant’s. Because the process feels identical to a normal transaction, the switch is often unnoticeable until it's too late. The scam capitalises on the widespread acceptance of the QRIS network across Indonesia. Another variation of this scam, known as 'quishing' (QR code phishing), involves a QR code that directs you to a fake website designed to steal your personal and financial information.
Key Steps to Protect Yourself
Vigilance is your best defence. Kaspersky and other cybersecurity experts recommend a multi-step approach to ensure your money and data remain secure while travelling. Before scanning any QR code, take a moment to inspect it. Look for signs of tampering, such as a sticker placed over another code or a code that looks poorly printed or damaged. Many modern phone cameras will show you a preview of the URL link before opening it; make sure it looks legitimate and matches the merchant. A legitimate business will not pressure you into making a quick payment.
Verify Before You Authorise Payment
The most critical step happens after you scan but before you pay. Your payment app will display the name of the recipient or merchant before you authorise the transaction. Always check this information carefully. Does the name match the shop you are in? Scammers often use personal or unrelated business names for their accounts. If the name looks suspicious or does not match, do not proceed with the payment. Instead, inform the merchant and consider using an alternative payment method like a credit card or cash. Enabling transaction notifications on your banking apps also helps you spot any unauthorised payments immediately.
Broader Digital Safety While Travelling
The QR code warning is part of a larger picture of travel-related cyber risks. Kaspersky advises tourists to be cautious when using public Wi-Fi networks for sensitive activities like banking. When booking flights and hotels, do so directly through official websites or trusted apps, not by clicking on links in unsolicited emails or messages. Use strong, unique passwords for all your travel-related accounts and enable multi_factor authentication wherever possible. A reliable security solution on your phone can also provide an essential layer of protection by detecting malicious links and phishing websites before they can do harm.
What to Do If You Are Scammed
If you suspect you've scanned a fraudulent QR code and made a payment, act quickly. Immediately contact your bank or card provider to report the transaction and block your card if necessary. Change the passwords for any accounts you believe may have been compromised, especially if the QR code led you to a phishing site where you entered login details. Monitor your bank statements closely for any further suspicious activity. Reporting the incident can help your financial institution take action and prevent others from falling for the same scam.
