A small black-and-white square can now connect shoppers with\nmerchants, tourists with public services, and small businesses with\nwider markets.<\/p>\n
All it takes is pointing a mobile phone camera at it, entering an\namount and confirming the payment. Transactions that once required cash\ncan now be completed in seconds.<\/p>\n
That convenience has become part of everyday life, including in\nSurabaya, East Java. At food stalls, markets, shopping centres and car\nparks, digital payments through the Quick Response Code Indonesian\nStandard (QRIS) are increasingly familiar. Buyers do not need to prepare\nexact change, while merchants can reduce the hassle of handling\ncash.<\/p>\n
But amid the speed, one habit must not be abandoned: checking where a\ntransaction is going before pressing the payment button.<\/p>\n
The issue came to the fore after the Surabaya city government\nfollowed up reports about QR codes displayed at micro, small and\nmedium-sized enterprise (MSME) stalls.<\/p>\n
The codes caused confusion because scanning them with a banking app\ndirected users to a payment page connected to a Chinese bank. Meanwhile,\nscanning them with Google Lens led to a page on the Google Play Store\nfor downloading the Si-Boyo app.<\/p>\n
The Surabaya Cooperatives, Small and Medium Enterprises and Trade\nOffice (Dinkopumdag) explained that the sticker was intended to promote\nSi-Boyo, a digital shopping platform integrating Merah Putih\nNeighbourhood Cooperatives (KKMP) and MSMEs, and was not a QRIS payment\ncode. The city government then said it would evaluate and recheck the QR\ncodes that had been installed.<\/p>\n
The incident points to a broader issue than simply misidentifying a\ncode. As more activities move into the digital sphere, people need more\nthan instruction on how to use technology. They also need to know how to\ncheck, distinguish and confirm that it is working as intended.<\/p>\n
One source of vulnerability in digital transactions is the assumption\nthat every QR code is a payment tool. In fact, QR codes can present\ninformation and direct users to a range of destinations, including\nwebsites, app downloads, product information and payment services.<\/p>\n
QRIS has a more specific function: standardising QR codes for\npayments. Bank Indonesia says people can make QRIS transactions using\nelectronic money apps, digital wallets or mobile banking services\nprovided by licensed payment service providers.<\/p>\n
Before completing a payment, users should check the merchant name\ndisplayed in the app and make sure they receive a transaction\nnotification.<\/p>\n
The issue at the Surabaya MSME stalls should therefore be examined\ncarefully. The city government\u2019s explanation that the sticker was used\nto direct people to an app does not, by itself, prove that fraud took\nplace. However, the different destinations shown by different scanning\napps warrant technical investigation.<\/p>\n
This is particularly important because the sticker reportedly\ndisplayed the Bank Mandiri logo and was placed at MSME stalls that also\nhad QRIS signs. In such circumstances, consumers may struggle to\ndistinguish the code for downloading an app from the one used to pay for\nfood.<\/p>", "url": "https:\/\/jawawa.id\/newsitem\/one-scan-but-stay-alert-1792547598", "image": "" }, "sponsor": "Okusi Associates", "sponsor_url": "https:\/\/okusiassociates.com" }