Sunday, December 3, 2023

Fake QRIS code, new threats to digital banking ecosystem

Reading Time: 2 minutes
Novi Nurmalasari


Mahinda Arkyasa



The recent case of fake QRIS codes installed in charity boxes presents a major hurdle amid Bank Indonesia’s efforts to develop a digital, tech-based payment system.

Moreover, the fact that the suspect, Mohammad Iman Mahlil, is a former bank employee means that “insiders” pose a great risk to the implementation of tampered QRIS codes.

In relation to the finding, cybersecurity expert Kaspersky has pointed out that there are quite a few vulnerabilities in QRIS that can be exploited by cybercriminals or hackers to do harmful actions. This is largely due to the fact that users cannot easily read the QRIS or verify the scanning process, making it easier for attackers to exploit these weaknesses.

The QRIS code created by criminals may lead to phishing sites that look like legitimate login pages for online banking or social networks. That’s why Kaspersky advises users to always check the link before tapping or clicking on it. 

Kaspersky also noted that hackers often use shortened links, making it more difficult for users to identify fake QRIS code when prompted for confirmation on their smartphones. This type of scheme can also trick users into downloading malicious software, instead of the intended game or tool, leading to potential security breaches.

In addition, QRIS code can also contain instructions to certain actions, such as adding contacts, making phone calls, drafting email and collecting recipient and subject lines, sending texts, sharing locations, and many more. 

It turns out that, despite all safety claims, QRIS can still be manipulated and breached. Therefore, to prevent this case from happening again, Bank Indonesia can only take precautions by pressing the payment service provider (PJP) to protect the system they are using. 

Bank Indonesia is also tightening the registration process of merchants who will use QRIS as their payment option. The central bank is coordinating with the Payment System Association (ASPI), payment system infrastructure providers, and PT Penyelesaian Transaksi Elektronik (PTEN) to investigate the risk of QRIS leaks.

Regarding PJP, ASPI has issued guidelines for merchants and users to improve the security of QRIS transactions. 

To ensure safe transactions, Bank Indonesia also encourages users to carefully check the information displayed within the payment application when scanning the code. This includes verifying the name of the merchant listed in the application and ensuring that it matches the correct merchant, and following the payment instructions provided by the merchant.

Merchants are also expected to regularly check their QRIS codes to ensure that they are indeed their own and have not been changed by unauthorized parties. 

Novi Nurmalasari


Mahinda Arkyasa




We will provide you with an invoice for your reimbursable expenses.


New to Indonesian market? Read our free articles before subscribing to the premium plan. If you already run your business in Indonesia, make sure to subscribe to the premium subscription so you won’t miss any intelligence & business opportunities.


$550 USD/Year


$45 USD/Month

Cancelation: you can cancel your subscription at any time, by sending us an email

Add keywords to your market watch and receive notification:
Schedule a free consultation with us:

We’ll contact you for confirmation.


The government is advised to exercise caution in developing nuclear power plants (NPPs) as their development poses various risks that require careful consideration.
Presidential and vice-presidential candidate Prabowo Subianto and Gibran Rakabuming Raka have outlined their vision to construct 10 innovation cities across Indonesia if they emerge victorious in the 2024 Presidential Election.
The government plans to encourage larger exports to non-traditional markets such as India, Pakistan, and Mexico. Indonesia’s exports have traditionally been dominated by China, the United States, and European countries. 
The Corruption Eradication Commission (KPK) is currently investigating three cases of alleged corruption in the Ministry of Agriculture (Kementan), involving the procurement of cattle, horticulture, and extortion.
PT PGN Tbk, a Subholding Gas under Pertamina, is committed to enhancing its responsiveness to customer complaints by implementing various initiatives.
The official establishment of the Comprehensive Investment and Policy Plan (CIPP) within the Just Energy Transition Partnership (JETP) marked a significant milestone in Indonesia’s move towards achieving net-zero emission.