Jakarta. Bank Indonesia is looking for other potential fraudsters after a man had been caught on camera misusing the Indonesian QR code payment system or the QRIS to scam charitable mosque-goers.

The Indonesian central bank is working with other bodies in the QRIS ecosystem, including the Indonesian Payment System Association (ASPI) and PT Penyelesaian Transaksi Elektronik Nasional or the National E-Transaction Settlement (PTEN), to identify similar schemes in other QRIS merchants.

“It is still an ongoing investigation. But we are coordinating with all parties within the ecosystem, but we have collected some [potential fraudsters]. We are currently checking whether they are related to this case or are using the same modus operandi. So of course, we still cannot announce it,” Fitria Irmi Triswati, the director for payment system policy at Bank Indonesia, told reporters in Jakarta.

“We also still do not have enough data on the total losses from this scam,” Fitria said.

According to Fitria, Bank Indonesia is also working alongside ASPI and PTEN to work on a blacklist system for deceitful QRIS merchants.

“Bank Indonesia will facilitate ASPI and PTEN to develop this blacklist. Any QRIS merchants on this blacklist are those who are identified as fraud or are proven to have committed violations. We are still discussing the mechanism with the Communications Ministry, ASPI, and PTEN,” Fitria said.

Previously, a man was caught on camera placing fraudulent QR codes on donation boxes at several mosques in Jakarta.

Read More:Police Arrest Man Who Uses QR Code to Steal Mosque Donations

The suspect is 38-year-old Mohammad Iman Mahlil Lubis. The police announced that the man had slapped the QR stickers at 38 locations, including Pejompongan gas station and Grand Indonesia shopping center. If scanned, the QR code that Iman had been distributing would link the user to transfer money to Restorasi Masjid (‘Mosque Restoration’).

Anyone who wishes to sign up as a QRIS merchant must go to a Bank Indonesia-licensed payment service provider. According to Fitria, the existing QRIS merchant verification mechanism is already good enough, and only needs more stringent supervision by the payment service provider to prevent similar schemes in the future. 

“For instance, the payment service provider can carry out a more detailed verification process such as by paying attention to the merchants’ profile, the donation flow, as well as the transaction history, etc.,” Fitria told the presser.

Bank Indonesia, however, refused to disclose the name of the payment service provider who issued the QRIS for Iman as the case was still under police investigation. 

Fitria said, “if there is any negligence or lack of know-your-merchant process done by the payment service provider [in the mosque donation scam case], we will refer to the existing regulations. There must be some sort of administrative sanctions such as warnings or license revocation. But that would have to depend on the results of our investigation if there are any violations [by the payment service provider].”

Iman previously signed Restorasi Masjid up as a regular QRIS merchant instead of a place of worship or a social donation. To sign up as a place of worship, the applicant must submit additional documents. A place of worship status would give Iman a 0 percent merchant discount rate.

As of Feb. 2023, Indonesia had 24.9 million QRIS merchants across its archipelago with 30.87 million users. The QR payment system has recorded 121.8 million transactions worth Rp 12.28 trillion ($823 million), Bank Indonesia data shows.