Planning a trip to Indonesia? The convenience of digital payments is undeniable, but a new warning from cybersecurity firm Kaspersky highlights a growing risk for Indian travellers: scams involving fraudulent QR codes.
Understanding QRIS and Its Popularity
Indonesia has rapidly adopted a unified
payment system called QRIS (Quick Response Code Indonesian Standard). This system allows anyone with a compatible digital wallet or banking app to pay at millions of merchants, from large restaurants to small street-side stalls, by scanning a single, standardized QR code. For tourists, including those from India, this offers immense convenience. India's UPI system is now connected to QRIS, allowing some Indian payment apps to work directly, though the rollout is still in progress. This interoperability, while beneficial, also creates new avenues for fraud that travellers need to be aware of.
How the QR Code Scam Works
The primary scam, a tactic known as 'quishing' (QR code phishing), is deceptively simple. Scammers place a sticker with a malicious QR code over a legitimate one at a payment counter. An unsuspecting tourist, often distracted or in a hurry, scans this fake code. Instead of being directed to the merchant's official payment gateway, the code can do one of two things: it can either redirect the payment to the scammer's own account or it can lead to a phishing website designed to look like a genuine payment portal. This fake site then tricks the user into entering sensitive financial information like card details, PINs, or banking passwords, which are harvested by the criminals.
Why Tourists Are Prime Targets
Cybercriminals specifically target travellers because they are often less familiar with local payment systems and norms. According to Noushin Shabab, a lead security researcher at Kaspersky, tourists are naturally more focused on discovering new places than on cybersecurity, making them attractive targets. They are more likely to use unfamiliar digital services, connect to public Wi-Fi, and make quick decisions without the usual level of scrutiny. This relaxed state of mind, combined with the pressure of a queue or the desire for a quick transaction, is exactly what fraudsters exploit.
How to Protect Yourself from QR Scams
Vigilance is your best defence. Before scanning any QR code, take a moment to physically inspect it. Look for signs of tampering, such as a sticker placed over another code. When you scan the code, your payment app should display the merchant's name. Always verify that this name matches the shop or restaurant you are in before you approve the transaction. If your app opens a web browser and asks you to enter login credentials or full card details, stop immediately—a legitimate QRIS payment does not typically require this. It's also wise to use dedicated payment apps rather than your phone's general camera app, as many banking apps have builtin security to detect suspicious links.
Additional Digital Safety Tips for Travel
Beyond QR codes, Kaspersky advises a broader approach to digital safety while travelling. Avoid using public Wi_Fi for sensitive transactions like banking; use a VPN for an encrypted connection if you must. Before your trip, enable multi_factor authentication on all your financial and travel_related accounts. Be wary of deals that seem too good to be true, especially those demanding urgent payment through unconventional methods. Finally, enable transaction notifications on your banking apps and regularly monitor your statements for any unfamiliar charges, reporting them to your bank immediately.
