One scan, but stay alert
A small black-and-white square can now connect shoppers with merchants, tourists with public services, and small businesses with wider markets.
All it takes is pointing a mobile phone camera at it, entering an amount and confirming the payment. Transactions that once required cash can now be completed in seconds.
That convenience has become part of everyday life, including in Surabaya, East Java. At food stalls, markets, shopping centres and car parks, digital payments through the Quick Response Code Indonesian Standard (QRIS) are increasingly familiar. Buyers do not need to prepare exact change, while merchants can reduce the hassle of handling cash.
But amid the speed, one habit must not be abandoned: checking where a transaction is going before pressing the payment button.
The issue came to the fore after the Surabaya city government followed up reports about QR codes displayed at micro, small and medium-sized enterprise (MSME) stalls.
The codes caused confusion because scanning them with a banking app directed users to a payment page connected to a Chinese bank. Meanwhile, scanning them with Google Lens led to a page on the Google Play Store for downloading the Si-Boyo app.
The Surabaya Cooperatives, Small and Medium Enterprises and Trade Office (Dinkopumdag) explained that the sticker was intended to promote Si-Boyo, a digital shopping platform integrating Merah Putih Neighbourhood Cooperatives (KKMP) and MSMEs, and was not a QRIS payment code. The city government then said it would evaluate and recheck the QR codes that had been installed.
The incident points to a broader issue than simply misidentifying a code. As more activities move into the digital sphere, people need more than instruction on how to use technology. They also need to know how to check, distinguish and confirm that it is working as intended.
One source of vulnerability in digital transactions is the assumption that every QR code is a payment tool. In fact, QR codes can present information and direct users to a range of destinations, including websites, app downloads, product information and payment services.
QRIS has a more specific function: standardising QR codes for payments. Bank Indonesia says people can make QRIS transactions using electronic money apps, digital wallets or mobile banking services provided by licensed payment service providers.
Before completing a payment, users should check the merchant name displayed in the app and make sure they receive a transaction notification.
The issue at the Surabaya MSME stalls should therefore be examined carefully. The city government’s explanation that the sticker was used to direct people to an app does not, by itself, prove that fraud took place. However, the different destinations shown by different scanning apps warrant technical investigation.
This is particularly important because the sticker reportedly displayed the Bank Mandiri logo and was placed at MSME stalls that also had QRIS signs. In such circumstances, consumers may struggle to distinguish the code for downloading an app from the one used to pay for food.