Cashless travel in Indonesia is easier than ever, with QR codes for payments at every turn. But a new cybersecurity warning urges caution as scammers are targeting these codes, turning convenience into a costly risk for unsuspecting tourists.
Understanding the 'Quishing' Threat
The scam,
a form of 'quishing' (QR code phishing), is simple but effective. Scammers print their own QR code sticker and physically place it over a legitimate merchant's code at a payment counter, restaurant table, or even on donation boxes. When a traveller scans the fraudulent code to pay for a meal or a souvenir, their payment app opens, and they authorize the transaction. However, the money is not sent to the shop owner but is instead diverted to the scammer's personal account. This happens in seconds, and with tourists often in a hurry or unfamiliar with the local language, the deception can easily go unnoticed until it is too late.
Why Indonesia's QRIS System is a Target
Indonesia has a standardized national payment system called QRIS (Quick Response Code Indonesian Standard). This system allows a single QR code to accept payments from dozens of different mobile banking and e-wallet apps, making it incredibly convenient for both merchants and customers. Its widespread adoption in everything from high-end hotels to street food stalls is a major factor in the country's push towards a digital economy. However, this ubiquity is precisely what makes it an attractive target. As more travellers from India and elsewhere rely on digital payments, scammers see a growing opportunity to exploit the system by tampering with these static, often unsupervised, QR code displays.
How to Spot a Tampered QR Code
Vigilance is your best defence. Before you scan, take a moment to inspect the QR code physically. Look for signs of tampering, such as a new sticker placed on top of an existing, laminated, or professionally printed code. A fraudulent code might feel flimsy, have a different finish, or look out of place. Also, be wary of QR codes that are not securely mounted and appear to have been hastily applied. Official QRIS codes from Bank Indonesia often have a standard design, including a logo and the merchant's details printed around the code itself. Any deviation from this should be treated with suspicion.
Your Five-Step Digital Safety Checklist
The most crucial step happens after you scan but before you pay. Always verify the merchant's name on your payment app's confirmation screen. If the name displayed does not match the name of the shop or restaurant you are in, do not proceed with the payment. Beyond that, follow these steps to stay safe: 1. Use only official payment and banking apps downloaded from the Google Play Store or Apple App Store. 2. Enable transaction notifications to quickly identify any unauthorized payments. 3. Where possible, ask the merchant to generate a dynamic QR code on their device for your specific transaction, rather than scanning a static sticker. 4. Be cautious when using public Wi_Fi for financial transactions; consider using a VPN for an encrypted connection. 5. Carry some cash as a reliable backup for situations where you feel a digital payment might be risky.
What to Do If You Suspect a Scam
If you complete a payment and then realize it may have gone to the wrong recipient, you must act quickly. Immediately contact your bank or the customer support for your e wallet provider through their official channels. Report the transaction as fraudulent, providing them with all the details, including the merchant's supposed name, the recipient name that appeared on your app, the time, and the amount. If possible, inform the legitimate merchant about the tampered QR code so they can take action to protect themselves and other customers. Taking a photo of the suspicious QR code display can also serve as helpful evidence for your bank.
