A genuine-looking payment sticker can still direct money to the wrong recipient. Indonesia QR scams are the subject of a new warning to Indian travellers, but the most useful precaution begins before scanning: check the payment method, then verify the name and amount shown by the app.
Cybersecurity company Kaspersky has warned about criminals replacing merchant QR codes or using codes to direct people to phishing pages. The warning, reported on 3 November 2026, concerns two different risks: authorising a payment to an unintended account, and disclosing credentials on a fraudulent website.
Indonesia's central bank, Bank Indonesia, publishes checks for users of its national QR payment standard, QRIS. Its guidance supports a practical response: verify the merchant, confirm the transaction and use a participating provider. A QRIS logo is not proof that every Indian payment app can pay it.
What are Indonesia QR scams trying to do?
A fraudulent code can redirect a payment or lead someone to a website designed to obtain sensitive information. Those are different actions, so the response depends on what the traveller actually did after scanning.
An altered payment code may display an account unrelated to the business where someone is buying a meal or paying for a service. If the customer authorises that payment, the transaction may succeed while the intended merchant remains unpaid.
A phishing code instead opens a page impersonating a bank, payment service or business. The page may request credentials or encourage a download. Scanning a code does not mean that every bank account has automatically been compromised; entering information, authorising payment and installing software are separate steps with different consequences.
Indonesia's National Food Agency computer-security response team, Badan Pangan-CSIRT, describes fake QRIS stickers and malicious codes circulated through messages. Its advice includes checking merchant names and website addresses and withholding PINs, passwords and one-time codes from suspicious pages.
What is QRIS, and does it work with Indian UPI apps?
QRIS is Indonesia's standard for QR-code payments through participating providers. Familiarity with UPI does not establish that an Indian app supports a particular Indonesian transaction.
Bank Indonesia's QRIS explanation describes a common standard through which eligible bank and non-bank payment services can process merchant payments. Cross-border use depends on participating countries and payment providers, rather than the visual appearance of the code alone.
In an October 2026 article describing connections in place by August, the central bank listed six partner countries: Malaysia, Thailand, Singapore, Japan, South Korea and China. That dated list does not establish that an Indian app has since launched support, nor should an announcement about a proposed connection be treated as proof it is operational.
Ask the bank or app provider whether payments in Indonesia are supported by the account you hold. Check fees, currency conversion, authorisation requirements and how to contact support abroad. If support cannot be established, arrange another method before relying on a QR code at the point of sale.
What is quishing?
Quishing is phishing delivered through a QR code. The code is a route to a fraudulent page or other deceptive action; it is not a guarantee that the destination belongs to the business displaying it.
Which seven checks should travellers make?
The seven checks concern app support, the physical code, the recipient, the amount, the website address, requests for secrets and the final transaction record. Each addresses a different point where a customer can stop an incorrect payment.
First, establish that the app and account can make the proposed payment. Second, inspect the displayed code for a sticker placed over another code or obvious tampering. Neither a professional design nor placement on a restaurant table proves authenticity.
Third, compare the recipient shown in the app with the business you intend to pay. If the names do not make sense, ask staff to explain and confirm another payment route. Fourth, check the amount and currency before authorising. Do not approve a second transaction merely because someone says the first one failed.
Fifth, inspect a website's full address before entering information. A page reached through a QR code can imitate a legitimate service. Sixth, stop if an unfamiliar page or message asks for a banking password, PIN or one-time code in a way you cannot verify through the official provider.
Seventh, inspect the payment result in your own app and retain the transaction record. A merchant's display or a message from a stranger should not substitute for your account's record of what was authorised and debited.
| What appears after scanning | What to check | When to stop |
|---|---|---|
| Payment confirmation screen | Recipient, amount and currency | Recipient or amount differs from the purchase |
| Restaurant menu or information page | Full website address and expected purpose | It unexpectedly requests financial credentials |
| Download prompt | Whether the app is genuinely required and from the official provider | A stranger asks you to install an unknown file |
| Claimed refund or payment failure | Your own transaction history and provider support | Someone demands another payment or secret code |
How should a payment be checked at the counter?
Read the confirmation screen before authorising and keep the receipt or transaction reference afterwards. Bank Indonesia's guidance emphasises verifying the merchant and checking transaction notifications.
If there is a discrepancy, pause the purchase and ask the business to identify its accepted payment methods. This is a verification step, rather than an accusation against the person serving you. A trading name and legal account name may differ, but the difference needs an explanation before money is sent.
An unexpected browser page should also prompt a pause. A QR code used to display a menu has a different purpose from a payment request. There is no reason to treat every page opened while ordering food as a trusted place to enter bank details.
Is this evidence that Indian tourists face a new wave of attacks?
The available material establishes a warning and known fraud techniques, rather than a verified count of Indian tourists harmed in Indonesia. The distinction matters when deciding how much weight to give a headline about travel risk.
Kaspersky's reported totals concern detections across a period running from the third quarter of 2025 to the second quarter of 2026. Detections are not automatically unique victims, completed thefts or losses suffered by Indians. A national detection total cannot establish the probability that one holidaymaker will be defrauded.
The warning is nevertheless consistent with older official guidance on QR-code tampering. The FBI's January 2022 alert described criminals redirecting users to malicious sites and advised verifying destinations and avoiding untrusted downloads. It establishes an existing technique, rather than evidence of a newly discovered Indonesia-only vulnerability.
What should someone do after a suspicious payment?
Contact the bank or payment provider immediately through its official app or independently verified support channel. Explain whether the problem was a wrong recipient, an unauthorised debit, credentials entered on a page or an app installed after scanning.
Preserve the transaction reference, amount, time, recipient details and any messages or website address. If it is safe to do so, retain a photograph of the suspicious payment display. These records help distinguish an ordinary dispute about a purchase from a suspected impersonation or account-security incident.
India's National Cybercrime Reporting Portal provides a reporting route for cybercrime. Indian police guidance also advises notifying the bank immediately about financial fraud. Reporting is not a guarantee of a refund, and it should not delay direct contact with the provider holding the account.
Do not use a recovery contact supplied by the suspected fraudster. A person offering to retrieve money in exchange for another payment or a secret code creates a further verification problem. Use the provider's own channel to establish the available dispute or account-protection process.
What does this mean for Indian travellers planning a trip?
Plan for supported payment methods and keep an alternative available. Payment provider DANA's guide to methods in Indonesia recommends a combination of cash, cards and digital payments; eligibility for any particular wallet still requires checking with that provider.
Before departure, test that you can open the official banking app and reach its support information. Establish how authentication will work while travelling, including access to the registered number if the provider requires it. Do not discover at a payment counter that the method you intended to use is unavailable.
Keep bank support details and transaction alerts accessible before leaving. Travellers can also review the guide to DigiLocker access abroad for document preparation and the overview of Indian travel trends when planning independent trips. Neither a stored identity document nor familiarity with digital payments authenticates an unfamiliar merchant code.
What happens next?
Travellers should check their provider's current Indonesia support before departure and repeat the recipient and amount checks at each payment. Cross-border coverage can change, so a dated partnership list should be read alongside the provider's current customer information.
The decision at the counter is straightforward: if the app is unsupported, the recipient unexplained or the page asking for unexpected credentials, stop and use a verified alternative. A quick scan should still leave time to understand what is being authorised.
.jpg){kind=link}