Friday, April 19, 2024

Fake QRIS code, new threats to digital banking ecosystem

Reading Time: 2 minutes
Novi Nurmalasari


Mahinda Arkyasa



The recent case of fake QRIS codes installed in charity boxes presents a major hurdle amid Bank Indonesia’s efforts to develop a digital, tech-based payment system.

Moreover, the fact that the suspect, Mohammad Iman Mahlil, is a former bank employee means that “insiders” pose a great risk to the implementation of tampered QRIS codes.

In relation to the finding, cybersecurity expert Kaspersky has pointed out that there are quite a few vulnerabilities in QRIS that can be exploited by cybercriminals or hackers to do harmful actions. This is largely due to the fact that users cannot easily read the QRIS or verify the scanning process, making it easier for attackers to exploit these weaknesses.

The QRIS code created by criminals may lead to phishing sites that look like legitimate login pages for online banking or social networks. That’s why Kaspersky advises users to always check the link before tapping or clicking on it. 

Kaspersky also noted that hackers often use shortened links, making it more difficult for users to identify fake QRIS code when prompted for confirmation on their smartphones. This type of scheme can also trick users into downloading malicious software, instead of the intended game or tool, leading to potential security breaches.

In addition, QRIS code can also contain instructions to certain actions, such as adding contacts, making phone calls, drafting email and collecting recipient and subject lines, sending texts, sharing locations, and many more. 

It turns out that, despite all safety claims, QRIS can still be manipulated and breached. Therefore, to prevent this case from happening again, Bank Indonesia can only take precautions by pressing the payment service provider (PJP) to protect the system they are using. 

Bank Indonesia is also tightening the registration process of merchants who will use QRIS as their payment option. The central bank is coordinating with the Payment System Association (ASPI), payment system infrastructure providers, and PT Penyelesaian Transaksi Elektronik (PTEN) to investigate the risk of QRIS leaks.

Regarding PJP, ASPI has issued guidelines for merchants and users to improve the security of QRIS transactions. 

To ensure safe transactions, Bank Indonesia also encourages users to carefully check the information displayed within the payment application when scanning the code. This includes verifying the name of the merchant listed in the application and ensuring that it matches the correct merchant, and following the payment instructions provided by the merchant.

Merchants are also expected to regularly check their QRIS codes to ensure that they are indeed their own and have not been changed by unauthorized parties. 

Novi Nurmalasari


Mahinda Arkyasa




We will provide you with an invoice for your reimbursable expenses.


New to Indonesian market? Read our free articles before subscribing to the premium plan. If you already run your business in Indonesia, make sure to subscribe to the premium subscription so you won’t miss any intelligence & business opportunities.


$550 USD/Year


$45 USD/Month

Cancelation: you can cancel your subscription at any time, by sending us an email

Add keywords to your market watch and receive notification:
Schedule a free consultation with us:

We’ll contact you for confirmation.


Minister of State-Owned Enterprises (SOEs) Erick Thohir has warned the Indonesian SOEs to anticipate the impact of global economic and geopolitical turmoil, citing the US inflation at 3.5 percent as indicator that the Fed would not lower the benchmark interest rate (Fed Fund Rate) in the near future.
President Joko “Jokowi” Widodo has approved the additional state capital injection (PMN) to PT Wijaya Karya (WIKA) amounting to Rp6 trillion (US$419 million).
PT Freeport Indonesia (PTFI) has deposited around Rp3.35 trillion (about US$207 million), or about sevent percent out of its 2023 profit of Rp48.79 trillion, to the regional administrations in Papua.
The Coordinating Ministry for the Economy held a coordination meeting with all Deputy Ministerial elements along with the Ministry of Foreign Affairs and several Ambassadors on Monday, April 15, 2024 in response to developments in the Middle East conflict following Iran’s retaliatory offensive against Israel. 
The textile and textile product (TPT) industry asks all stakeholders to comply with import restriction policies as regulated in Minister of Trade Regulations No. 36/2023 and No. 3/2024 on Import policy and control. 
The government has spoken out regarding Indonesia’s stance on Iran’s recent attack on Israel, asking the United Nations Security Council (UNSC) to take swift action to de-escalate tensions in the region.