Reference

QR Code Payments

A technical guide to EMVCo QR Code standards, Merchant Presented and Consumer Presented modes, and the regional QR payment ecosystems powering PIX, PromptPay, UPI, PayNow, QRIS and more.

QR Codes in Payments

QR code payments let a phone camera replace a card terminal. The payer scans a code displayed by the merchant (or the merchant scans the payer's code), and the payment is settled through the normal interbank rails — no physical card required. EMVCo published a unified specification in 2017 to prevent fragmentation; most national schemes now build on top of it.

$3T+QR payment volume/year (Asia)

40+Countries with national QR standards

ISO 18004Base QR code standard

CRC-16Integrity check algorithm

Two Presentation Modes

🏪

MPM — Merchant Presented Mode

The merchant displays a QR code (printed or on-screen). The customer scans it with their banking or wallet app. Payment is initiated by the customer's app.

Static QR — single fixed code, no amount encoded. Printed on merchant counter. Customer enters amount manually in their app.

Dynamic QR — generated per transaction, includes amount and reference. Shown on POS screen or receipt printer. One-time use.

Used by: PromptPay, PIX, PayNow, UPI, QRIS
Low hardware cost — any printer or screen suffices
Customer initiates and confirms the payment
Suitable for unattended, low-volume, and micro-merchant use

📱

CPM — Consumer Presented Mode

The customer shows a QR code on their phone. The merchant's terminal scans it. Payment is initiated by the terminal, similar to a card tap.

One-time code — dynamically generated by the wallet app, typically valid for 60–90 seconds. Rotates automatically.

Used by: Alipay, WeChat Pay, Google Pay (select markets)
Requires a 2D barcode scanner at the merchant
Faster checkout — no customer confirmation step
Closer to card-present UX; can include EMV data

Static vs. Dynamic QR

Feature	Static QR	Dynamic QR
Generated	Once — printed or saved	Per transaction by POS / app
Amount	Not included — customer enters	Encoded in the QR
Reference / TxID	Fixed or none	Unique per transaction
Point of Initiation	`01` = `11`	`01` = `12`
Reconciliation	Manual or periodic match	Automatic via TxID
Best for	Street vendors, low volume	Retail, e-commerce, table service
Risk	QR swapping attacks	Expiry / time-window attacks

QR Swapping Attack: A fraudster replaces the merchant's static QR sticker with their own. Customers scan and pay the fraudster. Dynamic QR (generated per transaction) eliminates this risk. For static QR deployments, merchants should use tamper-evident stickers and customers should verify the merchant name shown in their app before confirming.

Try the QR Parser

Parse and build EMVCo QR strings with live CRC validation and field-by-field decoding.

📱 EMVCo QR Parser & Builder 🔓 EMV TLV Decoder 🔢 BCD / Hex Converter 📡 NFC in Payments 📋 Certification Levels