A QR payment is a payment that begins when a phone camera or a shop scanner reads a QR code. The code is only a carrier of data. It holds the information needed to start a transaction, such as a merchant's account identifier, an amount or a customer's wallet credential, and the money itself then moves over an underlying rail: a wallet ledger, an instant bank transfer system or a card network.
QR payments spread first in China and then across Asia, Latin America and Africa because they need very little equipment. A merchant can accept payments with a printed sticker, and a customer needs only a phone with a banking or mobile wallet app. They are often compared with contactless card payments, which need a certified terminal and a card or phone with near-field communication.
Merchant-presented and consumer-presented modes
There are two basic modes, defined by who shows the code.
- Merchant-presented. The merchant displays a code and the customer scans it with their app, checks the merchant name, enters or confirms the amount and approves the payment. This is a push payment sent from the customer's account.
- Consumer-presented. The customer's app generates a short-lived code on the phone screen, and the cashier scans it with a handheld reader connected to the point of sale. The merchant's system then requests the money from the customer's wallet, so this mode behaves like a pull payment.
Merchant-presented codes are either fixed or generated per sale. A static QR is printed once and reused, with the customer typing the amount. A dynamic QR is created for each transaction and includes the amount and a reference, which removes keying errors and makes reconciliation easier.
Rails behind the code
What happens after the scan depends on the scheme. In closed wallet systems such as Alipay and WeChat Pay, the payment is a transfer between two accounts on the same provider's ledger, funded by a wallet balance or a linked bank card. In bank-based systems the scan triggers an instant account-to-account payment. India's Unified Payments Interface, Brazil's Pix, Thailand's PromptPay and Singapore's PayNow all use QR codes as a front end to a real-time bank transfer.
Card networks also support QR acceptance, in which the code leads to a card transaction processed through an acquirer. In every case the merchant is notified of success by its app, a sound box or a message to its till, and should not hand over goods on the strength of the customer's screen alone.
Standards and interoperability
Early QR schemes used their own data formats, so a merchant needed a separate code for each wallet. In 2017 EMVCo published QR code specifications for payment systems covering both the merchant-presented and consumer-presented modes. They define how fields such as merchant account information, category code, currency and amount are laid out in the code. Many national standards are built on this format, which lets one printed code hold identifiers for several schemes at once.
Central banks and industry bodies have gone further by requiring a single national code that every participating bank and wallet must be able to read. Several Asian countries have also linked their national QR systems bilaterally, so that a visitor can scan a local merchant code with their home banking app and pay in their own currency. These links depend on agreements between the operators and on settlement banks that handle the currency conversion.
Costs and economics
QR acceptance is cheap to set up because no card terminal is required. Ongoing fees vary widely. Some bank-based schemes charge merchants little or nothing for small payments as a matter of public policy, while wallet and card-based QR payments carry a merchant discount rate. Providers that receive little fee income often earn money from float, lending, advertising or other services sold to the merchants they have signed up.
Fraud and limitations
The simplicity of a printed code creates specific risks. A fraudster can paste a sticker with their own code over a merchant's, diverting payments until someone notices. Codes sent by email or left on parking meters and posters can lead to phishing sites rather than to a payment. Customers have also shown merchants fake confirmation screens. Schemes respond by displaying the registered merchant name before the customer approves, by signing codes digitally, and by giving merchants an independent confirmation channel.
QR payments also depend on a working phone, battery and data connection, and they take a few seconds longer than a card tap. For that reason they have gained less ground in markets where contactless cards were already widespread, and many providers support both a QR code and an NFC payment in the same app.