For Indians accustomed to the ease of UPI, scanning a QR code to pay is second nature. But as you plan your trip to Indonesia, a new warning from cybersecurity firm Kaspersky highlights the growing risk of scams targeting this very convenience.
A Familiar Habit Meets a New Threat
As more
Indian travellers flock to popular destinations like Indonesia, their reliance on digital payments is making them attractive targets for cybercriminals. Cybersecurity firm Kaspersky has issued a specific alert for tourists regarding scams involving Indonesia's national QR payment system, known as QRIS (Quick Response Code Indonesian Standard). While QRIS is widely and legitimately used by everything from restaurants to local vendors, its popularity has also drawn the attention of fraudsters looking to exploit unsuspecting visitors. Tourists are often less focused on cybersecurity, distracted by new surroundings, and unfamiliar with local payment systems, making them particularly vulnerable.
How the Scams Unfold
The primary scam method is deceptively simple but effective. Fraudsters will physically tamper with a legitimate merchant's QR code, often by placing a sticker with a fake code directly over the real one. When a tourist scans this tampered code, the payment is redirected not to the shopkeeper, but to the scammer’s account. Another variation is 'quishing' (QR code phishing), where a malicious code doesn't process a payment but instead directs your phone's browser to a fake website. This site might impersonate a bank or payment service, tricking you into entering sensitive information like login credentials or card details, which are then stolen.
Why Tourists Are Prime Targets
Cybercriminals specifically target tourists for several reasons. Travellers are often in a hurry, less likely to scrutinise a QR code, and may not immediately recognise if the merchant name that appears on their payment app is incorrect. Unlike in India where users are deeply familiar with UPI interfaces, the QRIS system and the apps that support it are new territory. Scammers exploit this lack of familiarity. Furthermore, a tourist might not notice a fraudulent transaction until hours or days later, by which time the scammer is long gone and disputing the charge becomes much more difficult from abroad.
Your Pre-Scan Safety Checklist
While the threat is real, a few simple checks can significantly reduce your risk. Before you scan any QR code in Indonesia, follow this checklist:
1. Physically inspect the code: Does it look like a sticker has been pasted over another code? Check for any signs of tampering. A legitimate QRIS code is often displayed on a professionally printed acrylic stand.
2. Verify the merchant name: After scanning the code but before authorising the payment, carefully check the merchant name that appears in your app. Does it match the name of the shop or restaurant you are in? If it shows a personal name or a different business, stop the transaction.
3. Use official payment apps: Only scan codes using trusted mobile banking or e_wallet applications. These apps often have security features that can flag suspicious links, whereas a simple phone camera app will not.
4. Avoid public Wi_Fi for payments: Unsecured public networks, like those in cafes or airports, can be monitored by hackers. Use your mobile data for financial transactions or a trusted VPN service.
5. Question 'too good to be true' offers: Be wary of QR codes promising huge discounts or prizes, especially from unknown sources. These are often lures for quishing scams.
What to Do If You Suspect Fraud
If a transaction feels off or you believe you've been scammed, act quickly. First, do not attempt the payment again. If you completed the transaction, immediately contact your bank or credit card company to report the fraudulent charge and inquire about blocking your card. Enable transaction notifications on your payment apps to spot unauthorised activity as soon as it happens. Monitor your bank statements closely for the next few days. If you were redirected to a website where you entered a password, change that password immediately on all accounts where you might have used it.
