<![CDATA[The rapid expansion of the Quick Response Code Indonesian Standard (QRIS) has strengthened Indonesia’s digital-payment infrastructure, but it has also increased the legal significance of unauthorized electronic transactions. This study examines how the existing Indonesian regulatory framework governs legal liability and consumer compensation for unauthorized QRIS transactions and formulates an ideal policy for incorporating the Time-Bound Tiered Liability Doctrine. It employs normative legal research through statutory, conceptual, and comparative approaches, drawing on Indonesian electronic-system, consumer-protection, and payment-system regulations, United States Regulation E, and European Union payment-services rules. The study finds that Indonesian law already recognises provider responsibility, consumer compensation, complaint handling, and fault-based exemptions. However, it does not establish a specific notification period, connect delayed reporting with the allocation of loss, distinguish initial loss from preventable additional loss, prescribe maximum consumer liability, or require provisional reimbursement within a substantive deadline. To address these deficiencies, this study proposes four reporting tiers: within 24 hours, after 24 hours to three business days, after three business days to seven calendar days, and after seven days to 60 days. Liability is determined by notification time, degree of fault, causation, and each party’s capacity to prevent or mitigate loss. Consumers who report promptly should receive full reimbursement, while unjustified delay may justify proportionate responsibility only for additional losses proven to have been preventable. The doctrine should be incorporated into a Bank Indonesia Regulation and implemented through technical rules and internal policies of payment service providers to promote legal certainty, proportional justice, and consistent consumer redress.]]>
