Indian travellers need to watch out for this one key risk when visiting Indonesia

As Indonesia continues to attract travellers from India, cybersecurity researchers have warned tourists about online threats, including fraudulent QR codes, phishing websites and attempts to steal personal and financial information.

According to cybersecurity company Kaspersky, tourists visiting the country may encounter several digital risks while searching for travel information, making online bookings, using public networks and making digital payments.

Also read: Hackers are targeting something the world cannot do without: Food


One of the key risks identified by Kaspersky's Global Research and Analysis Team (GReAT) is fraud involving Indonesia's QRIS payment system, the country's national QR payment network.

QRIS is widely accepted across shops, restaurants and local vendors in Indonesia. However, its widespread use has also made it a potential target for scammers. Fraudsters may replace or cover legitimate merchant QR codes with fake ones to redirect payments or steal financial information.

"Travel is a time when people naturally focus on discovering new places, not on cybersecurity. This is exactly what makes tourists attractive targets: they use unfamiliar digital services, connect from new locations and often make quick decisions. Our research shows that cybercriminals actively exploit these situations. By understanding the most relevant threats in each destination, travellers can take simple steps to protect their data and enjoy their journey with greater confidence," said Noushin Shabab, Lead Security Researcher at Kaspersky’s Global Research and Analysis Team (GReAT).

Also read: UK cyber chief says the UK will face AI cyberattacks on critical infrastructure by 2028

Travellers have been advised to check merchant details before confirming payments and avoid scanning QR codes from unknown or unofficial sources. They should also ensure that payment codes have not been altered or covered and verify website addresses before entering financial details.

Cyber threats detected in Indonesia

Kaspersky data recorded several types of cyber threats affecting users in Indonesia between the third quarter of 2025 and the second quarter of 2026.

These included 12,926,883 detections of general web threats, which may involve malicious websites and other online risks. The company also recorded 559,924 password stealer detections, involving threats designed to collect login credentials from browsers, applications and accounts.

There were 481,008 spyware detections, which can involve monitoring user activity and accessing sensitive information, and 2,847,403 backdoor detections. Backdoors can allow attackers to gain unauthorised access to infected devices.

How tourists can protect themselves

Kaspersky has advised travellers to book flights, accommodation and other travel services directly through official websites or applications rather than following links received through emails, text messages or social media.

Tourists should check website addresses carefully before entering payment details, as fraudulent websites can use domains resembling those of legitimate airlines, transport services and booking platforms.

Also read: Govt mulls giving Cert-In enforceable powers to mandate patching

The company has also recommended using strong and unique passwords for travel-related accounts and enabling multi-factor authentication wherever available. Travellers should download applications only from official app stores and review their permissions before installation.

Those using public Wi-Fi should take precautions while accessing email, banking services and travel accounts. Kaspersky has also recommended monitoring bank and card statements after making bookings and reporting unfamiliar transactions immediately.

The company also recommends checking QR code links before proceeding with payments or downloading applications. It says security tools with anti-phishing protection can help identify malicious websites and fraudulent payment pages before users share sensitive information.