.png)
The Payment Looks Complete. But Did Your Money Actually Go Through?
As digital payments become part of everyday life, a few seconds of verification can prevent a costly mistake.
ITSEC Asia
Imagine this: a customer scans a QRIS code, shows you a payment confirmation and waits for their purchase. The screen says “Payment Successful.” Everything looks right. You hand over the goods.
A few minutes later, you check your account. No money has arrived.
This is a growing concern as digital payments become part of everyday business in Indonesia. A transaction may look complete on someone's phone, but that doesn't necessarily mean the money has reached its destination.
According to data from the Indonesian Fintech Association (AFTECH), presented during the opening of Bulan Fintech Nasional (BFN) 2026, Indonesia had 70.59 million QRIS users and more than 49.39 million merchants as of September 2026. Around 96.7% of those merchants were micro, small and medium enterprises (MSMEs). [1]
These numbers show how deeply digital payments have entered everyday commerce. They also mean more transactions depend on users and merchants recognising when something isn't right.
A Screenshot Is Not Proof of Payment
On 11 November 2026, Bank Indonesia issued a reminder about fake QRIS payment receipts, warning merchants against relying solely on screenshots or payment confirmations displayed on customers' phones.
The reason is simple: digital payment receipts can be manipulated. Bank Indonesia explained that fraudulent receipts can be edited or even generated using artificial intelligence, including by changing the merchant name and transaction amount. [2]
Fraudsters can also reuse old receipts or claim that payment notifications are delayed. In a busy shop, where merchants handle several customers at once, a quick glance at a phone screen can be enough to miss the difference.
Consumers face similar risks. Fraudulent payment links, fake notifications and messages impersonating banks or e-wallet providers can direct users to websites designed to steal personal information or account credentials.
The scale of financial fraud in Indonesia makes this more than an isolated concern.
According to OJK's October 2026 report, the Indonesia Anti-Scam Centre (IASC) had blocked 702,833 accounts associated with suspected fraud and secured Rp825.2 billion in funds as of 30 September 2026. It had also facilitated the return of Rp207.16 billion to victims. [3]
The figures show why transaction security requires attention from both financial institutions and the people using their services.
Five Things to Check Before Completing a Digital Payment
Safer transactions don't require complicated procedures. They start with a few simple habits.
1. Verify the recipient before paying.
When scanning a QRIS code, check the merchant name displayed in your payment application. Make sure it matches the business you're paying.
2. Check the amount twice.
Confirm the transaction amount before entering your PIN or approving the payment. Be cautious if the displayed amount differs from the agreed price.
3. Don't rely on screenshots.
For merchants, wait for confirmation through your own payment application, merchant dashboard or official notification system. A screenshot provided by a customer isn't independent evidence that funds have arrived.
4. Be careful with payment links and urgent requests.
Fraudsters often use messages claiming that a payment has failed, an account needs verification or a transaction must be completed immediately. Avoid clicking unfamiliar links. Open your bank or e-wallet application directly instead.
5. Stop when something doesn't match.
If the recipient, amount or transaction status looks suspicious, don't proceed. Verify the details through the official channel of your bank or payment provider.
These checks take seconds. Recovering money from a fraudulent transaction can take considerably longer.
Security Is Part of the Fintech Experience
Bulan Fintech Nasional 2026 runs from 11 November to 12 December under the theme Fintech All Around You. It reflects how financial technology is becoming part of everyday activities, from shopping and paying bills to running a business.
But greater adoption also creates more opportunities for cybercriminals to exploit human behaviour, weak verification processes and vulnerable digital systems.
For fintech providers and businesses, consumer awareness needs to go hand in hand with technical security. Applications, websites and supporting infrastructure require regular security assessments to identify weaknesses before attackers find them.
For individual users, mobile protection can help reduce exposure to phishing websites and harmful links. ITSEC Asia's IntelliBroń Aman provides mobile security protection against phishing and other harmful online threats.
For organisations developing or operating digital financial services, application and infrastructure security also need regular testing.
This is where Bronyx AI comes in. Developed by ITSEC Asia, Bronyx AI is an AI-assisted autonomous penetration testing platform designed to help organisations identify exploitable vulnerabilities across their digital environments.
Find out how Bronyx AI can help your organisation assess its security exposure before attackers take advantage of it.
Digital payments should make everyday transactions easier. A simple habit of checking before confirming helps ensure that convenience doesn't come at the expense of security.
Before your next digital payment, take a moment to verify. The confirmation on the screen is only one part of the transaction.
References
[1] AFTECH / Finansial Fokus, 12 November 2026. QRIS adoption and fintech development in Indonesia.
https://www.finansialfokus.com/detail/1425273/aftech-7059-juta-pengguna-qris-buka-jalan-fintech-ke-sektor-riil
[2] Bank Indonesia, 11 November 2026. Cara Memastikan Pembayaran QRIS Benar-Benar Masuk.
https://www.bi.go.id/id/publikasi/ruang-media/cerita-bi/Pages/cara-memastikan-pembayaran-qris-benar-benar-masuk.aspx
[3] OJK, 27 October 2026. Satgas PASTI and IASC financial fraud enforcement update.
https://ojk.go.id/id/berita-dan-kegiatan/info-terkini/Pages/Satgas-PASTI-Tindak-Aktivitas-Keuangan-Ilegal%2C-Penipuan-Transaksi-Keuangan%2C-dan-Pergadaian-Ilegal.aspx
