As digital payments make travel in Indonesia easier, a new risk has emerged. Indian tourists using QR codes are advised to be vigilant, as scammers are using fake links to divert funds. Here’s how to protect yourself from these cyber threats.
The Convenience of Cashless Travel
Indonesia,
and Bali in particular, has seen a massive shift towards cashless transactions, making it incredibly convenient for tourists. The backbone of this system is the QRIS (Quick Response Code Indonesian Standard), a unified code that allows merchants to accept payments from various digital wallets and banking apps through a single QR code. From local food stalls (warungs) to upscale boutiques, the QRIS logo is nearly universal, reducing the need to carry large amounts of cash. While India's UPI and Indonesia's QRIS are expected to integrate by the end of 2026, for now, Indian tourists often use local apps like GoPay, which can be linked to an international card to facilitate these payments.
How the QR Code Scam Works
Cybersecurity experts have issued warnings about scams targeting this popular payment system. The primary method involves fraudsters tampering with legitimate QR codes. They might place a sticker with a fraudulent QR code directly over a merchant's official one. When an unsuspecting tourist scans this fake code, they are either directed to make a payment to the scammer's account instead of the merchant's, or they are sent to a malicious phishing website designed to steal personal and financial information like passwords and card details. Because tourists are often in a hurry and less familiar with local systems, they are considered attractive targets.
Your Pre-Payment Safety Checklist
Before you scan and approve any QRIS payment, take a moment to run through a quick mental checklist to ensure your money is going to the right place. First, always scan QR codes from within your official payment app (like GoPay or a banking app), not your phone's general camera app. Official payment apps have built-in security to detect invalid codes. Second, after scanning but before authorising, carefully check the merchant's name displayed in your app. Does it match the name of the shop or restaurant you are in? If there's a discrepancy, do not proceed. Finally, confirm the payment amount is correct before you enter your PIN or use biometric approval. A legitimate transaction will show the correct merchant name and amount for your confirmation.
Red Flags to Watch For
Developing an eye for potential scams is your best defence. Be cautious if a QR code looks physically altered, like a sticker has been pasted over another code. If a vendor pressures you to pay quickly, it could be a tactic to prevent you from properly verifying the transaction details. Another major red flag is if scanning a QR code prompts you to visit a website and enter login credentials or personal data; a legitimate QRIS payment happens entirely within your payment app. Also, never rely solely on a screenshot of a 'successful' payment shown by a vendor or a 'pending' transaction status as proof of payment. Always wait for the success confirmation within your own app.
Beyond QR: General Payment Safety in Indonesia
While QR code safety is paramount, it's wise to practice overall financial caution. When using ATMs, stick to machines located inside reputable bank branches (like BCA or Mandiri) to avoid skimming devices, which are more common at standalone machines. For currency exchange, only use authorised money changers that display a 'PVA Berizin' logo; street changers offering unusually high rates are notorious for short-changing customers through sleight-of-hand tricks. It is still a good idea to carry some cash for small purchases, tips, and in case of digital payment failures, but avoid carrying all your cash at once. Using a combination of secure QR payments, a credit card for larger establishments, and a small amount of cash provides the best flexibility and safety.
