QR Code

A QR code (Quick Response code) is a two-dimensional barcode made of black and white squares that a phone camera or scanner can read to retrieve text, a web address or payment details. In finance it has become one of the main ways to pay in shops in Asia and Latin America: a customer scans a code shown by a merchant, or shows one from their own app, and the payment travels over a wallet, a bank network or an instant payment system.

QR codes were invented in 1994 by Denso Wave, a Toyota group company in Japan, to track car parts, and were standardised internationally as ISO/IEC 18004. They are a data container, not a payment system: the code only carries information, and the money moves over rails such as UPI in India or Pix in Brazil. The same technology is used to share crypto addresses and, unfortunately, by fraudsters in "quishing" scams.

A QR code is like a printed note written in a code that only phones can read quickly. Instead of typing a long bank account number, a shop name and an amount, the customer points their camera at the square and the phone fills in the details instantly, with far fewer mistakes.

The note itself has no value and holds no money. It is closer to a pre-filled payment slip. That is why printing one is almost free for a small trader, and also why a fake slip stuck over the real one can send money to the wrong person.

Denso Wave's team, led by engineer Masahiro Hara, designed the code to be read faster and to hold more data than a traditional one-dimensional barcode. The company chose not to enforce its patent rights, which helped adoption. Key features include:

• Capacity. Codes range from version 1 (21 by 21 modules) to version 40 (177 by 177) and can hold up to 7,089 numeric characters.
• Error correction. Four levels allow a damaged or partly covered code to be read even when roughly 7%, 15%, 25% or 30% of it is lost.
• Finder patterns. The three large squares in the corners let a reader locate and orient the code from any angle.

Smartphone cameras that read QR codes without a separate app, which became standard in the late 2010s, turned them into an everyday tool.

There are two main ways a QR payment works:

• Merchant-presented mode. The shop displays a static or dynamic code and the customer scans it with a digital wallet or banking app, then approves the payment. This is the most common model for small traders because it needs no card terminal.
• Consumer-presented mode. The customer's app shows a code that the merchant scans at the till, much like a card at the point of sale.

In China, Alipay and WeChat Pay made QR payments the norm during the 2010s, often skipping cards altogether. India's UPI QR codes, Brazil's Pix, which launched in November 2020, and Pakistan's Raast are national real-time payment systems where a QR scan triggers an account-to-account instant transfer. Because these payments do not run on card rails, merchants often pay a lower merchant discount rate than for cards, or none at all.

To stop each country and wallet inventing its own format, EMVCo published the EMV QR Code Specification for Payment Systems in July 2017, covering both merchant-presented and consumer-presented modes. Many national standards, including Hong Kong's common QR code, are built on it, which helps interoperability so one code can be read by several apps, an aim discussed under interoperability in payments.

A wallet address is a long string that is easy to mistype, so crypto wallets display it as a QR code for the sender to scan. Bitcoin's BIP 21 standard defines a "bitcoin:" link format that can also carry an amount and label, and Ethereum has a similar format. Bitcoin ATMs typically ask users to scan a wallet QR code to receive coins. Some cold wallets use QR codes to pass signed transactions between an offline device and an online one without a cable.

QR codes are hard for people to check by eye, which criminals exploit:

• Quishing. Short for "QR phishing", this involves codes in emails, letters or posters that lead to fake login or payment pages. The US Federal Trade Commission warned consumers about such scams in December 2023.
• Tampered codes. Fraudsters stick their own code over a genuine one on parking meters or restaurant tables. The FBI issued a public warning about tampered QR codes in January 2022.
• Address swaps. Malware or fake payment requests can show a QR code for the scammer's wallet, a risk related to wallet address poisoning.

Many of these attacks rely on social engineering and urgency. Good practice is to check the name and amount shown in the app before approving, avoid scanning codes from unsolicited messages, and treat any payment that cannot be reversed, including authorised push payments, with extra care.

• Denso Wave: History of QR Code
• EMVCo: EMV QR Codes