Cashless payments in Indonesia are incredibly convenient, thanks to the unified QRIS system. But a growing scam involving tampered QR codes at shops and restaurants means travellers need to be vigilant. Here’s what you need to know.
The Rise of Scan-and-Pay Convenience
Across Indonesia, from
bustling Jakarta cafes to serene Bali warungs, a single, standardised QR code system has made payments seamless for locals and tourists alike. Known as QRIS (Quick Response Code Indonesian Standard), this system was launched by Bank Indonesia to unify the country's fragmented digital payment landscape. It allows anyone with a participating banking or e-wallet app—like GoPay, OVO, or DANA—to pay any registered merchant by scanning one code. The convenience is undeniable; you can buy street food, pay for souvenirs, or settle a restaurant bill without fumbling for cash. This ease of use has driven its massive adoption, making it a go-to payment method throughout the archipelago.
The Sticker Scam: A Simple but Effective Fraud
Unfortunately, the simplicity that makes QRIS so popular also makes it vulnerable to a low-tech but effective scam. Cybersecurity firms and Bank Indonesia have issued warnings about fraudsters physically tampering with merchant QR codes. The method is brazenly simple: a scammer prints their own QRIS code on a sticker and places it directly over a legitimate merchant's code. These fake stickers are often found at cashier counters, on restaurant tables, in parking lots, and even on mosque donation boxes. When an unsuspecting customer scans the code to pay for their meal or service, the payment is diverted to the scammer's account instead of the merchant's. The transaction appears successful on the user's phone, and the fraud often goes unnoticed until the merchant realizes their expected payments never arrived.
How to Spot a Tampered QR Code
While the scam is clever, there are several red flags you can look for before you scan. Being physically aware is your first line of defense. Pay attention to the physical condition of the QR code display. Scammers often place a sticker on top of the merchant's official acrylic stand or laminated sign. Look for raised edges, a crooked alignment, or a sticker that feels thick or flimsy to the touch. Official QRIS displays are typically well-printed and professionally presented. A fake one might look blurry, have faded colours, or show signs of being hastily applied. If the QR code looks like it has been tampered with or covered, it's best to be suspicious and use an alternative payment method.
The Most Important Check: Verify Before You Pay
The single most crucial step happens after you scan but before you approve the payment. Every official payment app will show you the registered merchant's name before you enter your PIN or confirm the transaction. This is your moment of verification. Always check that the merchant name displayed on your app matches the name of the shop or restaurant you are actually in. Scammers often register their QRIS accounts under generic or unrelated names like 'Mosque Restoration' or a personal name. If the name on your screen is different from the shop's name, do not proceed with the payment. Cancel the transaction immediately and alert the merchant that their QR code may have been compromised. This simple, three second check is the most effective way to prevent your money from going to the wrong person.
Your Digital Safety Checklist
To travel with confidence while using digital payments in Indonesia, keep these tips in mind. First, always use official payment apps from providers licensed by Bank Indonesia; never use your phone's generic camera app to scan a payment code. Second, enable realtime transaction notifications on your app to spot any unauthorized activity immediately. Third, be wary of QR codes sent to you via chat messages or social media, especially if they come with an urgent request to pay. Lastly, if you suspect you have been scammed, report the transaction to your bank or ewallet provider right away and inform the merchant where the incident occurred. Following these steps helps protect you and makes the payment ecosystem safer for everyone.
