Indonesia’s Quick Response Code (QRIS) payment system offers a seamless way to pay for everything from street food to souvenirs. But its convenience has also attracted scammers, who are increasingly targeting unsuspecting locals and travellers.
What Is QRIS and Why Is It So Popular?
QRIS is
Indonesia's national unified QR code standard, launched by Bank Indonesia to simplify digital payments. Instead of merchants needing multiple QR codes for different e-wallets like GoPay, OVO, or Dana, they can display a single QRIS code that works with any supported app. This has made cashless transactions incredibly convenient and widespread, especially for tourists who can often link their home banking apps or set up a local e-wallet to pay like a local. The system is designed to be fast, easy, and reliable, which has led to its universal adoption at millions of merchants, from high-end restaurants to small market stalls.
The Sticker Swap: How the Scam Works
The most common QRIS scam is deceptively simple and effective. Fraudsters print their own QRIS sticker, linked to their personal account, and physically place it over a legitimate merchant's code. This can happen anywhere: at a restaurant's cashier desk, on a vending machine, or even at donation boxes in places of worship. An unsuspecting customer scans the code, and their payment app shows a merchant name—often something generic like 'Merchant' or 'Toko'—which many people approve without a second thought. The payment is then instantly diverted to the scammer’s account, while the real merchant receives nothing. Because the transaction happens quickly, the fraud often goes unnoticed until the merchant realizes their expected payments haven't arrived.
Why Travellers Are Prime Targets
Travellers are particularly vulnerable to these scams for several reasons. They are often in a rush, less familiar with local business names, and may be distracted by the sights and sounds of a new place. A cybersecurity firm recently highlighted that tourists are attractive targets because they use unfamiliar digital services and make quick decisions while on holiday. Scammers exploit this by placing fraudulent codes in high-traffic tourist areas. When the payment app displays an unfamiliar or generic merchant name after scanning a code, a tourist is less likely to question it than a local who frequents the establishment.
How to Protect Yourself: A 3_Step Verification
Vigilance is your best defence. Before you ever confirm a payment, follow these crucial steps:
1. Check the Name: After scanning the QR code, your payment app will display the merchant's registered name. Make sure this name matches the shop, restaurant, or vendor you are paying. If the code is on a 'Warung Budi' stall but your app shows 'Restorasi Masjid' or a random individual's name, do not proceed.
2. Inspect the Sticker: Look for signs of tampering. Is the QRIS code on a flimsy sticker pasted over another, more permanent_looking sign? Official QRIS displays are often on acrylic stands or are well_integrated into the point_of_sale. If it looks like a cheap sticker that was recently applied, be suspicious.
3. Use Official Apps Only: Only initiate scans from within your official, trusted mobile banking or e_wallet application. Never use your phone's general camera app to scan a payment QR code, as fraudulent codes can lead to phishing websites designed to steal your credentials. An official payment app will not process a QR code that contains a web link.
What to Do If You've Been Scammed
If you suspect you've been a victim of a QRIS scam, act quickly. First, take a screenshot of the fraudulent transaction details. Immediately contact the customer service department of your bank or e_wallet provider to report the unauthorized payment and provide them with all the evidence you have. They can advise you on the next steps and may be able to trace or block the fraudulent account. It is also wise to report the incident to the merchant so they can check their own QRIS code for tampering. While getting your money back can be difficult, reporting the fraud helps authorities and payment providers track these schemes and potentially prevent others from falling victim.
