The convenience of booking flights and paying with a tap of your phone has transformed travel. But as you plan your next getaway, cybersecurity firm Kaspersky is flagging a growing number of digital threats targeting unsuspecting Indian tourists.
The Shifting Threat Landscape
As tourism
recovers, cybercriminals are doubling down on travellers. According to cybersecurity experts at Kaspersky, people are often less focused on digital security while on vacation, making them attractive targets. Scammers are creating highly convincing fake websites for airlines and booking platforms to steal money and personal data. In a recent report, Kaspersky noted that between the third quarter of 2025 and the second quarter of 2026, its systems detected nearly 13 million web-based threats in Indonesia alone, a popular destination for Indian tourists. These threats included everything from phishing websites to spyware designed to steal passwords and financial information.
The QR Code Trap in Indonesia
A specific risk highlighted for travellers in Indonesia involves the Quick Response Code Indonesian Standard (QRIS). QRIS is the national standard for QR code payments, and it's used almost everywhere, from small shops to large restaurants. While incredibly convenient, its widespread adoption has made it a prime target for fraud. Scammers physically place their own malicious QR code stickers over legitimate ones. An unsuspecting tourist scans the code to pay for a meal or souvenir, but the payment is redirected to the scammer's account instead. Because you are in a new environment and likely in a hurry, it is easy to miss the signs of tampering.
How to Spot a Malicious QR Code
Before you scan any QR code, take a moment to inspect it physically. Check if the code is on a sticker that has been placed over another one; look for lifted corners or a different finish from the sign it is on. When you scan, most modern phones preview the destination URL. Read it carefully. Scammers often use lookalike domains with subtle misspellings or extra words. If the URL looks suspicious or uses a link shortener, do not proceed. Always confirm the merchant's name on your payment app screen matches the shop you are in before authorising the transaction. If you have any doubts, ask the staff to confirm the code is legitimate.
Fake Bookings and Phishing Scams
Beyond payment codes, online booking scams remain a significant threat. Fraudsters create elaborate fake websites that mimic major platforms like Booking.com or wellknown airlines. These sites can look identical to the real thing, but are designed solely to harvest your credit card details and personal information. Kaspersky warns that Trojans—malicious software designed to steal banking credentials—are frequently disguised as travel-related files. To stay safe, always book directly through a company's official app or by typing its website address into your browser yourself. Avoid clicking on links in unsolicited emails or messages, even if they advertise a deal that seems too good to be true.
Essential Digital Safety for Any Trip
A few simple habits can dramatically improve your digital security abroad. First, avoid using public Wi‑Fi for sensitive transactions like banking or booking flights. Your mobile data or a Virtual Private Network (VPN) offers a much more secure connection. For all your travel‑related accounts, use strong, unique passwords and enable multi‑factor authentication (MFA) wherever possible. This adds a critical layer of security. Finally, enable transaction alerts for your credit and debit cards. This ensures you'll be notified immediately of any suspicious charges, allowing you to report fraud to your bank quickly.
