Indonesian Police Warn of QRIS Payment Scams: A Till Routine Before You Hand Over Goods

On 15 October 2026 the Jakarta Metropolitan Police (Polda Metro Jaya) urged the public always to check the merchant name and the payment service provider before paying with QRIS, Indonesia's national QR payment standard. The appeal, reported by Okezone, followed a viral post on Threads about paying by scanning a QR code displayed on someone else's phone.

A day later Katadata reported that the Indonesia Anti-Scam Centre (IASC) had received 702,342 fraud reports between 22 November 2024 and 30 September 2026. One method it named was online shopping fraud using fake proof of payment.

The police appeal is addressed to buyers. Sellers stand on the other side of the same transaction and have two interests: the buyer must be sure the money reaches the right shop, and the shop must be sure the money has arrived before goods change hands. The advice below is our own extension for sellers, not a quotation from the police. It is a routine against the QRIS payment scam from the shop's side of the counter.

What the police said

Senior Commissioner Budi Hermanto, head of public relations at Polda Metro Jaya, was quoted by Okezone as saying that the force urges the public always to check the merchant name and the payment service provider.

The accompanying advice:

• Before entering a PIN, check the merchant name and payment service provider on the confirmation screen, and the amount. If they do not match, cancel.
• If you have already paid, keep evidence: screenshots, the reference number, time, amount and merchant identity.
• Report at once to the bank or payment service provider, and keep the complaint ticket number.

The report does not say where the viral incident took place and gives no loss figures per method.

First interest: your shop's name must be right on the buyer's screen

The police advice only helps if buyers know which name should appear. This is where a seller can help.

1. Scan your shop's QRIS code with your own phone. Look at the merchant name and provider name on the confirmation screen, then cancel before paying.
2. If the name shown differs from the name on your signboard, for example the owner's name or a company name, careful buyers will hesitate. Write beside the code: "Name shown when scanning:" followed by the exact name.
3. Check the QRIS sticker or stand every morning. Make sure no other sticker has been placed over it and that no extra code sits on the counter that does not belong to the shop.
4. Keep the QRIS code where the cashier can see it, not in an unwatched corner.
5. Make sure all staff know which codes are officially the shop's. If there is more than one, number them.

Train cashiers to say one sentence as the buyer scans: "Please check, the name should appear as" followed by your merchant name. That sentence protects the buyer and shows your shop is careful.

Second interest: the money must show on the shop's side

A buyer showing a phone screen that says "successful" has proved nothing to the shop. The screen may be an old screenshot, an edited image or a payment to another code. Katadata lists fake proof of payment among shopping fraud methods.

The basic rule is single: goods are released after money appears on a device or report belonging to the shop, not on the buyer's phone.

A till routine we suggest:

1. State the amount clearly, then invite the buyer to scan.
2. Wait for the notification in the merchant app, the point-of-sale machine or the shop's notification speaker.
3. Match three things: amount, time and, where available, the sender's name or last digits.
4. If they match, hand over the goods and receipt.
5. If no notification has arrived, ask the buyer to wait a moment and refresh the transaction history in the merchant app. Do not use the buyer's screen as a substitute.
6. If it still does not appear, offer another payment method or hold the goods until it is clear. Say politely that this is the routine for every buyer.

For this to work, the cashier must be able to see incoming money without depending on the owner's personal phone. If notifications reach only your phone and you are away, the cashier is forced to trust the buyer's screen. Ask your QRIS provider how to give cashiers view-only access to transaction history.

For orders taken over chat

The same pattern applies when a buyer sends a photo of a transfer slip or QRIS payment proof over chat.

• Do not process an order from an image alone.
• Match it with the bank statement or transaction report before packing.
• Watch for pressure: "I have transferred, please send quickly, the courier is waiting". Pressure is a reason to check more carefully, not faster.
• If the amount in the image is higher than the bill and the buyer asks for the excess back, stop and check the statement first.

What to record when a transaction looks odd

The police advise victims to keep evidence and a ticket number. A shop should have a similar habit. Keep an incident book at the till and fill it in whenever something is wrong:

• Date and time.
• Amount that should have been paid.
• What the buyer showed, photographed with permission if possible.
• Reference number, if any.
• Name of the cashier on duty.
• Action taken: goods held, paid another way, or already released.

If goods were released and the money turns out not to have arrived, report to your bank or payment service provider with those notes and keep the ticket number. If the shop has camera footage, secure a copy before it is overwritten.

A summary to stick by the till

• Say the amount. Say the merchant name.
• Wait for the notification on the shop's device.
• Match amount and time.
• The buyer's screen is not proof.
• In doubt? Hold the goods, call the person in charge.
• Record anything odd.

If many of your orders come in over chat, Polynusa offers a shared WhatsApp inbox on the business number with notes per customer, and bookkeeping that records invoices and payments, so the staff packing an order can see whether it has been paid.

Sources

• Okezone via RCTI+, 15 October 2026: QRIS scams on the rise, police urge residents to check the merchant name before paying
• Katadata, 16 October 2026: OJK receives 702,000 fraud reports, how to protect your money

FAQ

What did police advise about QRIS scams?

According to Okezone, Jakarta police urged people to check the merchant name, the payment service provider and the amount on the confirmation screen before entering a PIN, and to cancel if they do not match.

Can a cashier release goods after seeing a payment screenshot?

Our advice is no. Release goods once the money shows in the shop's own notification or transaction report, since fake proof of payment is among the methods named in Katadata's report.

What should a victim do?

Keep evidence such as screenshots, the reference number, time, amount and merchant identity, report at once to the bank or payment provider, and keep the complaint ticket number.