As Indian tourists flock to Indonesia, the convenience of QR code payments comes with a hidden risk. Cybersecurity experts are issuing warnings about a growing scam where fake codes are used to steal money before a payment is even completed.
The Rise of 'Quishing' in Tourist Hotspots
The practice
of paying for everything from street food to souvenirs with a quick scan of a QR code has become second nature for many. However, this convenience is being exploited by criminals in a tactic known as 'quishing'—or QR code phishing. Cybersecurity firm Kaspersky has recently highlighted this threat, specifically for travellers in Indonesia. The country's national QR payment system, QRIS, is widely adopted, making it a prime target for fraudsters. These scammers create malicious QR codes that, when scanned, can redirect your payment to their own account or lead you to a fake website designed to steal your personal and financial data. This isn't just a minor issue; phishing attempts are a significant problem across Southeast Asia, with millions of incidents detected. For a tourist focused on their holiday, it's an easy trap to fall into.
How the Scam Works at the Counter
The most common method is deceptively simple and effective. Scammers will visit busy shops, cafes, or tourist attractions and physically place a fraudulent QR code sticker over the merchant's legitimate one. This fake sticker can be expertly designed to look almost identical to the real thing. An unsuspecting tourist, perhaps in a hurry, scans the code to pay for their purchase. Their payment app opens, and they are prompted to enter their PIN or authorize the transaction. Instead of the money going to the shopkeeper, it's instantly transferred to the scammer's account. In other variations, the QR code might direct you to a phishing website that looks like a genuine payment gateway or even your bank's login page, tricking you into entering sensitive credentials that criminals can then capture and use.
Red Flags: How to Spot a Fake QR Code
Vigilance is your best defence. Before you scan any QR code, take a moment to inspect it physically. A sticker placed on top of another code is a major red flag. Look for peeling edges or a design that doesn't quite match the merchant's branding. Most modern smartphones will show a preview of the website URL before it opens. Read this carefully. If the URL looks suspicious, contains typos, or is different from the merchant's name, do not proceed. Be wary of any situation that creates a sense of urgency, pressuring you to act fast. After scanning, but before you pay, your app should display the recipient's name. Always double-check that this name matches the merchant you are intending to pay. If there's any doubt, it is always better to cancel the transaction and ask the vendor to confirm their details.
Protecting Your Money While Abroad
Beyond spotting fake codes, there are several proactive steps you can take. Whenever possible, use a merchant's official app for payments instead of scanning a publicly displayed code. When booking travel or accommodation, do so directly through official websites rather than clicking on links in unsolicited emails. Avoid using public Wi_Fi for any financial transactions; if you must, use a trusted Virtual Private Network (VPN) to encrypt your connection. Enable multi_factor authentication on all your financial apps and accounts for an added layer of security. It is also wise to enable transaction notifications on your phone, so you are immediately alerted to any unauthorised payments from your account. These simple habits can significantly reduce your risk of falling victim to a scam.
What to Do If You've Been Scammed
If you suspect you have scanned a malicious QR code and lost money, you must act quickly. The first step is to contact your bank or credit card issuer immediately to report the fraudulent transaction and block your card. If you entered any passwords on a suspicious site, change them right away for that account and any others where you use the same password. It's also important to report the incident. In India, you can call the national cybercrime helpline at 1930 to register a complaint. Preserve any evidence you have, such as the transaction ID and screenshots of the payment confirmation. Reporting the fraud not only helps in your own case but also provides valuable information to authorities to prevent others from being scammed.
