Indonesia’s QRIS payment system offers incredible convenience for travellers, but recent alerts highlight a growing fraud risk. Scammers are targeting tourists with a simple but effective trick. Here’s what you need to know to pay safely.
What is QRIS and Why is It Everywhere?
If you are travelling
to Indonesia, especially popular spots like Bali, you will see the black-and-white QRIS logo everywhere, from street food stalls to high-end boutiques. QRIS, or Quick Response Code Indonesian Standard, is the country's unified payment system. Launched by Bank Indonesia, it allows anyone with a compatible digital wallet or banking app to pay any merchant by scanning a single, standardised code. This system has revolutionised payments, making transactions cashless, quick, and easy for locals and, increasingly, for tourists. For visitors from countries with cross-border agreements like Malaysia, Singapore, and Thailand, you may even be able to use your home banking app directly. For others, local apps like GoPay can often be linked to foreign cards, providing a gateway to this convenient ecosystem.
The Sticker Scam: How Fraudsters Exploit QRIS
The very simplicity of QRIS is what fraudsters are exploiting. The most common scam involves criminals physically placing a fraudulent QR code sticker on top of a legitimate one at a merchant's payment counter. This can happen anywhere: in restaurants, at parking meters, and even on donation boxes in places of worship. Unsuspecting tourists, focused on their holiday and accustomed to the ease of QR payments, scan the code, enter the amount, and approve the transaction. However, because the fraudulent code is linked to the scammer’s personal account, the money is diverted directly to them instead of the merchant. The victim often only realises something is wrong when the merchant reports they have not received the payment.
Your Three-Second Safety Check
The most effective defence against this type of fraud is a moment of vigilance before you confirm payment. Cybersecurity experts and Bank Indonesia urge users to develop a simple habit: always verify the merchant's name on your phone screen after scanning the code. Your payment app will display the name of the account that will receive the money. If you are at a cafe called 'Bali Beans', but your app shows a payment going to a personal name or a completely different business, that is a major red flag. Do not proceed with the payment. This three-second check is the single most important step you can take to protect your funds.
More Tips to Transact Safely
Beyond verifying the merchant name, there are other precautions travellers should take. Visually inspect the QR code standee or sticker; if it looks like a sticker has been pasted over another one, or if it seems tampered with, exercise caution and consider paying with cash or a card instead. Only scan QR codes from trusted sources and within official payment apps authorised by Bank Indonesia; never scan a code sent via a messaging app or social media. Also, ensure you are on a secure internet connection, preferably your own mobile data, rather than unsecured public Wi_Fi when making payments. Keeping transaction notifications enabled on your banking app will also help you spot any unauthorised payments immediately.
What to Do If You Become a Victim
If you suspect you have been scammed, act quickly. First, contact the bank or financial institution linked to your payment app to report the fraudulent transaction and inquire about reversing the charge. Gather any information you have, including the merchant's location, the time of the transaction, and the name that appeared on your payment screen. You should also report the incident to local police. While getting your money back may be difficult, reporting the fraud helps authorities track these schemes and can prevent other travellers from falling into the same trap. Remember to also inform the legitimate merchant, as they may be unaware that their QRIS code has been compromised.
