1

QR Code Merchant Payments

A growth opportunity for mobile money providers

In partnership with
The GSMA represents the interests of Accourt is a specialist, IP-led global NTT DATA is a leading IT services
mobile operators worldwide, uniting payments consultancy, providing strategic provider and global innovation partner AUTHORS
more than 750 operators with nearly and operational payments consultancy headquartered in Tokyo, with business
400 companies in the broader mobile services worldwide. Its consultants are operations in over 50 countries. Our
ecosystem, including handset and device experienced practitioners with front line emphasis is on long-term commitment,
GSMA
makers, software companies, equipment P&L experience, combining unrivalled combining global reach with local intimacy
Anant Nautiyal, Senior Manager,
providers and internet companies, as strategic expertise with operational to provide premier professional services
Inclusive Tech Lab
well as organisations in adjacent industry know-how. From defining and setting varying from consulting and systems
Bart-Jan Pors, Director,
sectors. The GSMA also produces the strategy, implementation, through to final development to outsourcing. Inclusive Fintech Mobile Money
industry-leading MWC events held annually delivery, Accourt is dedicated to minimising
Bruno Martins, Technology Lead,
in Barcelona, Los Angeles and Shanghai, operational risk and ensuring a successful For more information, visit Inclusive Tech Lab
as well as the Mobile 360 Series of regional outcome for its clients. Accourt has a www.nttdata.com
conferences. passion for delivering real and lasting value
Accourt
and brings focused, world-class expertise
Vaughan Collie, Managing Partner
For more information, please visit to complement client teams.
the GSMA corporate website at
NTT Data
www.gsma.com For more information about Accourt,
Akihiro Ishizuka, Global Head of Payments
please visit www.accourt.com
Jannen Vamadeva, Head of Fintech
Follow the GSMA on Twitter: @GSMA

Research contributors:
Ryo Hoshino, Manager, Security
THE MOBILE MONEY PROGRAMME IS SUPPORTED BY THE BILL & MELINDA GATES FOUNDATION Engineering Department; Yoneda Ayaka,
QR Code Technology R&D; Taguchi
Hirotomo, QR Code Technology R&D; Takita
Mika, QR Code Technology R&D; Foong Lye
Mun, Payments Marketing Manager
 Contents

Section 4: T
 echnical specifications of leading
Executive summary 4 26
QR code payment schemes

Section 5: C
 harting a course for interoperable
Section 1: Rationale for this report 8 33
QR code merchant payments

Section 2: The rise of QR codes in payments 12 Section 6: Key trends, findings and call to action 40

Section 3: T
 hree primary QR code merchant
19 Appendices 49
payments flows
Executive
summary
 Executive summary 5

Mobile money providers (MMPs) are key players In 2019, 640 million Alipay customers regularly 10

USD trillion
in the provision of financial services in emerging transacted in two or more Alibaba Group
markets. MMPs now see QR code merchant ecosystem product/service categories. Another
payments as a potential adjacent opportunity to 190 million regularly transact in five or more
8
expand their products and services and target categories.
potential incremental revenue streams.
While this report does not advocate a “copycat”
Globally, digital payments are expected to reach approach of the Chinese market and its players,
6
an annual transaction value of USD 4.4 trillion we can learn much from events in China and
in 2020, with 17 per cent CAGR through 2024.* many other schemes around the world, whether
With growth rates like this, it is not surprising newly emerging, rapidly growing or somewhere
that merchant payments have captured the in between. 4
interest of many stakeholders, including MMPs.

QR code payments are enjoying significant but

fragmented global growth, often competing 2
with long-established payment methods, such
as card payments. There are a number of QR
code schemes around the world, but none more
0
successful than the two primary Chinese players, 2017 2018 2019 f2020 f2021 f2022 f2023 f2024
Alipay and WeChat Pay.
Digital commerce Mobile POS payments
 Executive summary 6

To facilitate this, the report provides an insight The interoperability journey

into a wide range of QR code deployments and

Maturity and sophistication

specifications globally – including the Chinese DOMESTIC CROSS-BORDER
giants (Alipay, WeChat Pay) of course, but also Government/regulator-led
other QR code specifications like EMV, JPQR, multilateral cross-border
interoperability
Bharat QR, HKQR, SGQR, QRIS, Prompt Pay,
Mercado Pago and Pix, among others.

QR code merchant payments present a

significant, but potentially complex opportunity Government/regulator-led
bilateral cross-border
for MMPs, and the challenges and strategic interoperability
Government/regulator-led
benefits must be considered carefully. domestic interoperability
Bilateral outbound/
In particular, interoperability is a crucial inbound interoperability

requirement for the industry to achieve a

harmonised customer experience for QR code
merchant payments, driving customer adoption, Closed loop outbound/
inbound interoperability
transaction volumes and overall profitability. Provider
consolidation
Joint venture/consortium
limited open loop scheme

Proprietary, closed
loop scheme

Elapsed time
Executive summary 7

Key lessons
• MMPs with large and active USSD • QR code merchant payments • Regulatory approaches and
customer bases will need to carefully have several key enablers and interventions differ between
consider the best course of action interdependencies, most of geographies, for example, African
to avoid excluding these customers which must be addressed to and Chinese regulators have played
from the QR code payments journey, increase chances of success. For a limited role until now (although this
while also recognising and addressing example: device affordability, is changing), while Southeast Asian
practical challenges, such as device internet connectivity, wallet/bank and Indian regulators have played an
affordability and connectivity. account penetration and merchant extremely active role in QR schemes
distribution. from the outset.
• Having a core ecosystem of products
and services that continues to drive • Market dynamics and nuances are • On its own, a QR code merchant
high levels of customer engagement important. While developing markets payments P&L is unlikely to be
is crucial. (Payments should support in Asia tend to have high smartphone compelling. Rather, value will
these ecosystems; they are not the and internet penetration, developing be derived from data. However,
ecosystem). markets in Africa tend to have low QR codes have the potential to
smartphone and internet penetration. significantly accelerate digitisation
These call for fundamentally different of economic activity in emerging
approaches. markets, paving the way for additional
tailored services to be provided to
customers, leading to further revenue
streams.
 • QR codes are an increasingly ubiquitous

Rationale for payment channel around the world.

• In emerging markets, mobile money

this report providers are at the forefront of using QR

codes, but face several challenges.

• This report is intended as a resource for

mobile money providers that wish to adopt
and/or grow their QR code merchant
payments ecosystems.
 QR codes are an increasingly ubiquitous payment channel 9

around the world

In 2018, Chinese consumer and business mobile The rapid growth of mobile and digital payments Consumer digital payments
payment volumes reached USD 41 trillion,* about around the world offers mobile money providers Top five countries, volumes (f2020)
30 per cent ($13 trillion) of which were QR code (MMPs) an opportunity to expand their mobile
payments, primarily through Alipay (founded in money ecosystems to provide mobile payment China 44%
2004) and WeChat Pay (founded in 2011). services to consumers and merchants.
1,921
Other countries, such as Denmark, India, South Currently, the mobile payments market is
Korea and Sweden, also have high mobile being served by MMPs, fintechs, smartphone United States 20%

payments adoption rates, with the US, Canada, providers, e-commerce providers and banks. 896
Norway and Japan not far behind. Within mobile payments, QR code merchant
payments are growing rapidly across Asia, Africa Japan 4%
Global mobile payments** adoption is
and Latin America.
expected to grow by about 27 per cent 165
(CAGR, 2020–2025). QR code merchant payments offer a
United Kingdom 4%
significant opportunity for MMPs, but they are
As a subset of mobile payments, consumer
not without challenges. 164
digital payments volumes are expected to top
$4.4 trillion in 2020.*** The top five countries South Korea 2%
account for almost 75 per cent of the total, but
all of Africa contributes just 1.8 per cent of the 114
total.
Rest of World 26%

* All values are in US dollars 1,147

** This includes mobile-based NFC payments
*** Statista, 2020 (adjusting for expected effects of COVID-19)
US$ billions
 In developing markets mobile money providers are at the forefront 10

of using QR codes, but face several challenges

Developing markets, such as those on the MMPs in developing markets are seeking especially as few users will tolerate having many
African continent and Indian sub-continent, to expand their mobile money ecosystems wallets.
have for a long time been exploring the mobile into merchant payments by building on core
The approach that MMPs take to understanding
money opportunity from different perspectives, strengths established through their mobile
and addressing these and other issues will
typically to support basic use cases, such money initiatives.
define the nature and degree of their success in
as mobile top-ups or person-to-person
While QR code merchant payments are the QR code merchant payments ecosystem.
remittances.
considered an attractive opportunity, many
Many of these initiatives have been successful existing challenges remain and some new
despite many barriers. In these markets, challenges have emerged. For example:
adoption has been limited by, for example:
• Deep penetration of feature phones that rely
• high unbanked populations; upon USSD transaction dialogues and do not
• fragmented and unreliable mobile internet support scanning of QR codes;
connectivity; and • Many divergent views and specifications that
• lack of affordable devices. have been developed globally as part of the core
QR code ecosystem design.
Some markets, such as India, have managed to
overcome many of these challenges, typically With concentration around two key players,
with concerted and sustained government-led China is relatively unique. This is seldom the
initiatives. For example, India now has enviably case in other territories, and competition will
high levels of bank account penetration across therefore be aggressive, but consolidation will
the entire population. likely result in only the most successful surviving,
 This report is intended as a resource for mobile money providers 11

that wish to adopt and/or grow their QR code merchant payments

ecosystems

Since MMPs will be at different stages The objective of this report is to examine the opportunities and
challenges of QR code merchant payments by:
in their QR code merchant payments
journeys, this report is intentionally • sharing insights on the QR code merchant payments ecosystem and
various initiatives around the world;
broad to support MMPs regardless
of their current focus, whether it be • describing QR code merchant payments in the context of a journey to
help MMPs identify where they are in their respective journey;
basic QR code merchant payments
acceptance, more sophisticated • highlighting key lessons that can be elicited from various initiatives
ecosystem interoperability or stages in around the world;

between. • sharing insights and perspectives on some of the fundamental technical

considerations of QR code merchant payments, and

• sharing insights and perspectives on the impacts and implications of

some of the major trends in QR code merchant payments.

All the above will be synthesised into a proposed call to action for
MMPs as they move forward with their respective QR code initiatives.
 • Originally a tool for tracking automobile

The rise of machine parts, the rise of QR codes in

payments was enabled by the widespread

QR codes in adoption of digital wallets.

• Uptake has been high in China, and their

payments relatively inexpensive form factor and ease

of use has helped make QR codes popular in
other parts of the world.

• Today, prominent QR code merchant

payments deployments are evident around
the globe.
 Originally a tool for tracking automobile machine parts, the rise of 13

QR codes in payments was enabled by the widespread adoption of

digital wallets
Types of QR codes Origins and history of QR codes The evolution of QR code payments

A QR code is similar to a bar code except it can One of the core enablers of QR code payments
store a larger amount of information per unit has been the mobile wallet. Principally, mobile
Model 2 Micro QR iQR code SQRC FrameQR area. It is a two-dimensional code that is capable wallets can operate as:
of 360-degree (omni-directional) high-speed
• A link to a primary value store, such as a
reading.
customer card/bank account. Transactions
Invented by Denso Wave in Japan Initially used in the automotive industry for debit the value from the primary account via the
in 1994, the use of Quick Response production, tracking and shipping, QR codes wallet. No preloading of the wallet is required.
(QR) code has grown in popularity expanded beyond the automotive industry
from its origins in the automotive into identification and marketing use cases and
manufacturing industry through finally payments.
to today’s merchant payments
China has played a crucial role in the rapid
ecosystems.
growth of QR code mobile payment services,
enabling businesses to accept digital payments
without investing in any hardware, such as point • A virtual store of value, such as digital/virtual/
of sale (POS) terminals. mobile money that is preloaded into the wallet.
Transactions debit the value from the wallet
balance.

Note: some wallets offer both models

 Relatively inexpensive and easy to use, QR code payments 14

are becoming popular in other parts of the world

QR code merchant payments Person-to-person (P2P) payments

In merchant payments, QR codes have been • Static QR codes: Typically printed stickers found QR codes can be used for P2P payments.
used to replace or complement traditional POS at merchant check-out locations or displayed
devices and interact almost seamlessly with on customer device screens. They hold specific
Biometric payments
compatible ecosystem mobile wallets. data elements and do not change.
Fingerprint and facial biometrics are enjoying
The form factor and presentation of a QR code • Dynamic QR codes: Dynamically generated
a great deal of attention in payments and
differ depending on the merchant/transaction at the time of the transaction and require a
could ultimately replace QR code payments in
context, but the following are the primary merchant or customer screen to display. They
certain circumstances. The scenario considered
dimensions to consider: are typically valid for a short period and contain
here extends beyond using a biometric to
several contextually unique data elements.
• QR code model: Model 2 is available on a authenticate/authorise a card or QR code
free-to-use licence from Denso. It has sufficient • Merchant-presented mode (MPM): The MPM transaction.
data payload capabilities to effectively support transaction journey requires a customer to scan
For example, the facial recognition biometric
payments transactions, and is therefore the the merchant’s static or dynamic QR code to
becomes the payment token and, apart from
most common form factor in QR code payments initiate a transaction.
the merchant’s biometric scanner, no device
currently. Other models of QR codes are
• Customer-presented mode (CPM): The CPM (e.g. smartphone), card or QR code are required.
available from Denso, but are typically subject
transaction journey requires the merchant to Please see Appendix A for further insights.
to a licence fee and often require specialised
scan the customer’s static or dynamic QR code
scanners.
to initiate a payment transaction.
 15

Not just a Chinese phenomenon

There is significant focus on QR code Around the world, initiatives tend to Developing Asian markets, such as
merchant payments around the world, be either proprietary or government/ Indonesia, Thailand and other Southeast
across developing and developed regulator-led, and each market has Asian countries, are also heavily
markets alike. unique opportunities and challenges. regulator-led, with some seeking to
avoid card payments entirely.
Adoption remains fragmented and, in MMPs in Africa continue to explore QR
some markets, typically Europe, the UK code merchant payments in addition to India’s high levels of bank account
and North America, incumbent card- their existing mobile money offerings. penetration have enabled the regulator
based merchant payments continue to to pursue an ambitious, multi- faceted
In mature Asian markets, such as China,
dominate. merchant payments strategy with QR
Japan, Korea and Taiwan, regulators
codes and card payments operating
The primary drivers of adoption vary have ultimately taken the lead in
side by side.
between markets, but with most pursuing domestic interoperability
developing markets focused on and, in some cases, cross-border
reducing the use of cash, improving interoperability.
financial inclusion and providing a
relatively low-cost, non-cash merchant
payments option.
 Today, QR code deployments are evident around the globe – 1 of 3 16

some prominent regional examples

Asia and Middle East

$1,920.5bn 16.4% 902M $16.4bn 10.7% 5.2M $113.5bn 14.9% 37M $165.2bn 16.0% 88M Expected total annual digital payments*
transaction value in USD (f2020)
CHINA HONG KONG SOUTH KOREA JAPAN
Alipay Standard: Faster Standard: ZeroPay Standard: JPQR Expected total annual digital payments
WeChat Pay Payment System KakaoPay Paypay transaction growth rate (CAGR, 2020–2024)
Wechat Pay HK NaverPay LinePay
Alipay HK RakutenPay Number of digital payments users (f2020)
dPayment
Transaction value for digital payments (f2020)
$6.0bn 19.2% 72M $2.19bn 9.0% 11M
$1,001bn–$2,000bn
PAKISTAN TAIWAN
Easypaisa Standard: TaiwanPay $101bn–$1,000bn
JazzCash JAPAN JKOPAY
$50bn–$100bn
Kenuu Wallet CHINA $165bn LinePay*
$1,921bn <$50bn
$10.0bn 19.0% 39M
$15.4bn 24.2% 21M KOREA
$114bn PHILIPPINES
SAUDI ARABIA INDIA
PayMaya
STC Pay $69bn
G Cash
Halalah
BayanPay
$11.8bn 6.5% 13M
MALAYSIA
$69.3bn 24.2% 590M National: DuitNow
INDIA Boost * The digital payments market segment is led by consumer
Standard: Bharat QR Touch ‘n Go transactions and includes payments for products and services
PayTM GrabPay** which are made over the internet as well as mobile payments at
MobiKwik RazerPay point-of-sale (POS) via smartphone applications. Includes:
Online processed payment transactions, mobile POS payments
$9.0bn 16.0% 88M $8.1bn 19.6% 36M $34.6bn 16.5% 130M $14.6bn 12.4% 3.1M processed via smart devices at point of sale, digital consumer
commerce transactions (e.g. credit card, online payment
THAILAND VIETNAM INDONESIA SINGAPORE providers, etc.). Does not include mPOS solutions (dongle
Standard: PromptPay/ThaiQR Momo Standard: QRIS Standard: SGQR payments) for card payments or mobile card readers,
TrueMoney ZaloPay GoPay NETSPay business-to-business payments, electronic banking (eBanking),
LinePay** ViettelPay OVO GrabPay provision fees from payment providers.
VNPay Linkaja
** Providers where headquarters located in other country
GrabPay** T-Cash
 Today, QR code deployments are evident around the globe – 2 of 3 17

some prominent regional examples

Africa
$2.8bn 16.0% 12M $8.1bn 25.6% 41M Expected total annual digital payments*
transaction value in USD (f2020)
MOROCCO EGYPT
inwi money mVisa** Expected total annual digital payments
Masterpass** transaction growth rate (CAGR, 2020–2024)

$2.2bn 32.1% 6.6M Number of digital payments users (f2020)

$1.2bn 34.3% 7.6M
GHANA UGANDA
mVisa** MTN** Transaction value for digital payments (f2020)
MTN* $8.1bn–$10.0bn
Airtel*
$2.9bn 31.0% 16M
$4.1bn–$8.0bn
KENYA
mVisa** $1.0bn–$4.0bn
$9.3bn 17.9% 65M
M-Pesa <$1.0bn
NIGERIA
mVisa**
$0.7bn 38.2% 2.5M
MTN*
RWANDA
mVisa**
DEMOCRATIC M-Pesa
REPUBLIC OF CONGO
M-Pesa** $1.1bn 31.8% 6.6M
TANZANIA
M-Pesa** * The digital payments market segment is led by consumer
$0.5bn 34.5% 0.7M
Tigo Pesa transactions and includes payments for products and services
BOTSWANA Airtel Money which are made over the internet as well as mobile payments at
Ecocash** point-of-sale (POS) via smartphone applications. Includes:
$1.5bn 36.9% 3.6M Online processed payment transactions, mobile POS payments
processed via smart devices at point of sale, digital consumer
$8.1bn 23.7% 26M ZAMBIA
commerce transactions (e.g. credit card, online payment
FNB
SOUTH AFRICA providers, etc.). Does not include mPOS solutions (dongle
MasterPass** payments) for card payments or mobile card readers,
MTN MoMo $1.3bn 36.9% 3.6M business-to-business payments, electronic banking (eBanking),
SnapScan ZIMBABWE provision fees from payment providers.
Zapper Ecocash ** Providers where headquarters located in other country
 Today, QR code deployments are evident around the globe – 3 of 3 18

some prominent regional examples

Latin America
$32.0bn 18.8% 51M Expected total annual digital payments*
MEXICO transaction value in USD (f2020)
MEXICO $32.0bn VENEZUELA
Mercado Pago** Mercado Pago** Expected total annual digital payments
CoDi transaction growth rate (CAGR, 2020–2024)
Number of digital payments users (f2020)

$8.2bn 12.6% 22M $51.4bn 33.2% 105M

Transaction value for digital payments (f2020)
COLOMBIA BRAZIL $41bn–$52bn
Mercado Pago** Standard: PIX***
Mercado Pago** $21bn–$40bn
$10bn–$20bn
<$10bn

BRAZIL
$8.5bn 19.8% 11M $51.4bn $1.9bn 52.4% 1.3m
CHILE URUGUAY
Mercado Pago** Mercado Pago**
VALEpie**
Todo Pago**
Ualá*
* The digital payments market segment is led by consumer
transactions and includes payments for products and services
which are made over the internet as well as mobile payments at
point-of-sale (POS) via smartphone applications. Includes:
Online processed payment transactions, mobile POS payments
$15.4bn 28.7% 25M processed via smart devices at point of sale, digital consumer
commerce transactions (e.g. credit card, online payment
ARGENTINA
providers, etc.). Does not include mPOS solutions (dongle
Mercado Pago
payments) for card payments or mobile card readers,
VALEpie
business-to-business payments, electronic banking (eBanking),
Todo Pago
provision fees from payment providers.
Ualá
** Providers where headquarters located in other country
Three primary • From a product flow perspective, a QR
code payment solution can be understood

QR code as a combination of nine interdependent

elements.

merchant • Each element has several options under it to

choose from.

payments • Three broad product flows are possible

for QR code merchant payment solutions

flows depending on how elements are grouped and

the transaction characteristics.

• Each product flow results in a distinct

experience for the payer and payee of a
QR code solution.
From a product flow perspective, a QR code payment solution can 20

be understood as a combination of nine interdependent elements

Communication channel EC
Transaction channel
The network and communication channel F2F
In-store/face-to-face
the customer/merchant device uses or remote

Device Transaction authentication

Smartphone, smart feature phone, Method the customer uses to
feature phone authenticate for the transaction
(PIN/password/biometric)

QR code presentation Customer connectivity

Whether the QR code is Is the customer connected to
presented by the merchant the communication channel or
or the customer not (typically the internet)

Payment type PUSH

Merchant connectivity
Push payments are typically PULL Is the merchant connected to the
initiated by the customer, communication channel or not
pull payments are are initiated (typically the internet)
by the merchant

QR code type
Static or dynamically generated
QR code
 Each element is underpinned by several interdependent options 21

QR codes harness several key, QR code merchant payments require Comms Internet connectivity USSD connectivity
channel
interdependent elements to support these key elements to work together as Feature phone, Smartphone,
Device Smartphone, feature phone
successful, wide-reaching merchant seamlessly as possible. The extent to which Smart feature phone

payments. The adjacent diagram this is achieved will have a fundamental QR code
1
Merchant Presented Mode (MPM)
2
Customer Presented Mode (CPM)
3
Merchant Presented Mode (MPM)

impact on factors such as:

presentment
illustrates the top-down dependencies, (customer scans QR code) (merchant scans QR code) (customer manual keyed entry)

Push payments (RTP),

with communication channels and device Payment type Push payments
Pull payments
Push payments

• the customer and merchant payment

capabilities being the most fundamental QR code
type
Static
QR code
Dynamic
QR code
Static
QR code
Dynamic
QR code
Static
QR code**
Dynamic
QR code**
types accepted;
elements to unlock the various modalities Merchant
connectivity
Merchant Merchant
Merchant online Merchant online
offline online
of QR code merchant payments. • the customer and merchant payment Customer
connectivity
Customer online Customer offline, online Customer offline, online
acceptance rates;
For example, USSD connectivity will Transaction
authentication
PIN, password, biometric PIN, password, biometric PIN

take users along a route of manual data • the channels in which customers can Transaction
E-commerce, face-to-face E-commerce*, Face-to-face Face-to-face
channel face-to-face
capture that typically excludes QR codes transact; and
from this type of transaction.
• the overall merchant/customer transaction
Conversely, a smartphone coupled experience.
with internet connectivity enables
both customer-scanned (i.e. merchant- The following sections will delve into
presented mode) and merchant-scanned how these components work together
(i.e. customer-presented mode) QR code to create various types of QR code
transactions. Additional options then merchant payment transaction flows and
appear depending on whether a static or capabilities.
dynamically generated QR code is used
in the transaction.
 Three broad product flows are possible for QR code merchant payment 22

solutions depending on how elements are grouped and the transaction

characteristics
There are three primary interaction options
between customers and merchants that have Comms Internet connectivity USSD connectivity
enabled QR code payments: channel

Feature phone, Smartphone,

• Merchant-presented mode (MPM) Device Smartphone, feature phone
Smart feature phone

• Customer-presented mode (CPM) 1 2 3

QR code Merchant Presented Mode (MPM) Customer Presented Mode (CPM) Merchant Presented Mode (MPM)
• Merchant-presented USSD presentment (customer scans QR code) (merchant scans QR code) (customer manual keyed entry)

These three product flows are illustrated below Push payments (RTP),
Payment type Push payments Push payments
in the context of their interdependencies. Pull payments
The following pages will summarise the key QR code Static Dynamic Static Dynamic Static Dynamic
entities and steps during an in-store purchase type QR code QR code QR code QR code QR code** QR code**
transaction. Merchant Merchant Merchant
connectivity Merchant online Merchant online
offline online

Customer
connectivity
Customer online Customer offline, online Customer offline, online

Transaction
authentication
PIN, password, biometric PIN, password, biometric PIN

Transaction E-commerce*,
channel E-commerce, face-to-face Face-to-face Face-to-face
* Only possible when customer is online face-to-face
** Merchant identifier must be visible in human readable format,
to be keyed in by customer
*** Refer to Appendix A for a description of each element
   
1 Each product flow results in a distinct experience for 23

the payer and payee of a QR code solution:

Merchant-presented QR code payment

QR code payment transaction type: MPM with a static QR code sticker is a typical implementation for micro-merchants where no/low payment Applies to:
acceptance costs are critical. These merchants are typically transitioning from cash-only acceptance.
• Merchant Presented (MPM)
MPM with dynamic QR codes is more typical of larger, more sophisticated merchants where they have the
• Static or Dynamic QR code
POS capability to generate and display a dynamically generated QR code
• Push payment
Smartphone Smart feature
phone

OFFLINE – NO DATA CONNECTIVITY REQUIRED ONLINE – DATA CONNECTIVITY REQUIRED

MERCHANT PRESENT 2a 3a
STATIC QR CODE

1 4 5 6

Customer scans merchant Customer inputs

static QR code sticker payments total.

Customer opens payment Customer authorises payment Customer receives Merchant receives payment
app with QR code scanner payment confirmation confirmation. Customer takes
on smartphone/ smart 2b 3b goods, merchant waits to
feature phone. receive settlement of funds.

TRANSACTION ASYNCHRONOUS
AUTHORISATION MESSAGE
MERCHANT PRESENT
DYNAMIC QR CODE
Customer scans Customer checks payment
dynamically generated details including amount
merchant QR code Provider system API Merchant system
   
2 Each product flow results in a distinct experience for 24

the payer and payee of a QR code solution:

Customer-presented QR code payment

QR code payment transaction type: CPM with a static or dynamic customer QR code (on a smartphone or feature phone screen) relies on Applies to:
merchants having the capability to scan these QR codes at checkout.
• Customer Presented (CPM)
CPM can either initiate a push or pull payment. In the case of a pull payment the merchant will seek
• Static or Dynamic QR code
authorisation against customer funds. In the case of a push, the merchant will send a Request To Pay (RTP)
• Push (RTP) or Pull payment to the customer. The customer will then authorise this payment by initiating a push payment directly from a
Smartphone Smart feature
bank/wallet account. phone

OFFLINE – NO DATA CONNECTIVITY REQUIRED ONLINE – DATA CONNECTIVITY REQUIRED

4a Merchant scans QR. decodes

CUSTOMER PRESENT data, sends to POI system and
PULL PAYMENT METHOD authorisation system
1 2 3 6

Merchant scans QR, decodes data, Customer sent payment

sends to POI system and wraps details to authorise and
data payload into a Request to Pay then receives
(RTP) message payment confirmation
4b 5b
Merchant scans goods Customer opens payment Customer app displays QR code (static) Merchant receives payment
and enters transaction app with QR code payment on or generates a one-time confirmation. Customer takes
details on system smartphone / smart feature phone QR code (dynamic). Merchant goods, merchant waits to
scans customer’s QR code. receive settlement of funds.
CUSTOMER PRESENT
PUSH PAYMENT METHOD TRANSACTION
AUTHORISATION

ASYNCHRONOUS
MESSAGE

Merchant Provider API Merchant system

system system
   
3 Each product flow results in a distinct experience for 25

the payer and payee of a QR code solution:

Merchant-presented QR code payment (USSD)

QR code payment transaction type: In this scenario, the customer uses a feature phone that cannot scan QR codes and is therefore required to Applies to:
manually key the number printed adjacent to the merchant’s QR code sticker (e.g. Merchant ID) to initiate a
• Merchant Presented (MPM)
USSD dialogue to complete the transaction.
• Static or Dynamic QR code*
This is not strictly a QR code payment transaction as the QR code is not scanned. This type of transaction
• USSD payment exists solely to enable feature phone payments within QR code payments schemes, i.e. backwards
Feature
compatibility in feature phone dominated markets. phone**

OFFLINE – NO DATA CONNECTIVITY REQUIRED. PAYMENT THROUGH USSD CHANNEL

1 2 3 4 5

Merchant rings up goods Customer opens payment app, USSD gateway asks customer USSD gateway asks for mobile Merchant receives payment
and enters transaction details. USSD gateway asks for merchant for transaction amount to be money banking PIN to be confirmation. Customer takes
ID number which customer enters. entered. entered to authorise transaction. goods, merchant waits to
receive settlement of funds.

Example QR
code sticker:

982309
USSD Provider USSD USSD Provider USSD USSD Provider API Merchant
gateway system gateway gateway system gateway gateway system system

* Irrespective of whether a static or dynamic code is presented, a unique, human readable number is required to uniquely identify the merchant transaction.
This number is typically the Merchant ID and is manually keyed into the feature phone by the customer to initiate a USSD dialogue.
** Technically possible on smartphones and smart feature phones, but unlikely to be provisioned as such apart from as an atypical fallback option.
Technical • Any QR code payment scheme has an
underlying technical specification that

specifications
governs all its aspects.

• The technical specifications underpinning QR

of leading QR
code payment schemes can be proprietary or
common.

code payment
• A summary comparison of different QR
specifications across their constituent
components reveals many overlaps, but also
schemes significant points of divergence.

• Understanding the technical specifications of

QR code payment solutions is useful because
they represent one of two possible routes to
interoperable QR code merchant payments.
 Any QR code payment scheme has an underlying technical specification 27

that governs all its aspects

In addition to the payments components

covered under product flow (see the diagram
below), the technical specifications of a QR Communication channel Transaction channel
EC
code solution also encompass: The network and communication channel F2F
In-store/face-to-face
the customer/merchant device uses or remote
• Authentication approach: various customer
and merchant authentication approaches, Device Transaction authentication
Smartphone, smart feature phone, Method the customer uses to
from PINs and passwords to biometrics feature phone authenticate for the transaction
• Data payload scope: the scope of data (PIN/password/biometric)

elements embedded within the QR code

QR code presentation Customer connectivity
Whether the QR code is Is the customer connected to
presented by the merchant the communication channel or
or the customer not (typically the internet)

Payment type PUSH

Merchant connectivity
Push payments are typically PULL Is the merchant connected to the
initiated by the customer, communication channel or not
pull payments are are initiated (typically the internet)
by the merchant

QR code type
Static or dynamically generated
QR code
 The technical specifications underpinning the design of QR code 28

payment schemes can be proprietary or harmonised

At the highest level, The matrix below shows examples of major QR code Examples of major QR code ecosystem players that have
when designing a ecosystem players that have chosen to develop and chosen to develop and implement a more harmonised
QR code payments implement proprietary specifications, along with the QR code approach, some using EMVCo’s EMV specification for QR code
scheme, providers presentment modalities they support. payments:
can elect to adopt a
proprietary approach Proprietary specifications approach Harmonised specifications approach
or a more open,
Example schemes MPM CPM Example schemes MPM CPM
harmonised design
approach. Alipay Supported Supported EMV QR code specs Supported Supported

WeChat Pay Supported Supported Hong Kong Common QR Code (HKQR) Not
Supported
(Hong Kong Interbank Clearing Limited) supported
MTN Supported Not
supported
SGQR
Supported Supported
Not (Monetary Authority of Singapore)
M-Pesa Supported supported
JPQR
Not Supported Supported
Mercado Pago Supported supported (Payments Japan)

Kakao Pay Supported Supported Bharat QR

(National Payments Corporation of India Supported Supported
(NPCI))

Thai QR Payment/MyPromptQR Supported Supported

Quick Response Code Indonesian Standard

Supported Supported
(QRIS)
 A summary comparison of QR specifications across their  1 of 3 29

constituent components reveals many overlaps, but also

significant points of divergence
Summary: Core QR code payments components can be summarised across the example schemes as follows:

Specification Comms channel Device QR code presentment QR code type Txn channel

EMV
Smartphone MPM, CPM
JPQR

Bharat QR Smartphone, feature phone Dynamic, static

Harmonised
MPM Face-to-face
specifications
HKQR

SGQR Internet connectivity MPM, CPM

QRIS MPM Static

Smartphone
Alipay
MPM, CPM Face-to-face, remote
WeChat Pay Dynamic, static

Proprietary
Prompt Pay Face-to-face
specifications
MPM
M-Pesa USSD connectivity Smartphone, feature phone Static
Face-to-face, remote
Mercado Pago Internet connectivity Smartphone MPM, CPM Dynamic, static
 A summary comparison of QR specifications across their  2 of 3 30

constituent components reveals many overlaps, but also

significant points of divergence
Summary: Authentication and authorisation approaches across the example schemes are as follows:

Specification Authentication approach When* Detail

EMV No mandatory requirements — EMVCo has not provided any mandatory requirements for authentication.

JPQR does not specify any mandatory requirements, so the authentiation varies by company.
JPQR No mandatory requirements —
JPQR recommends PIN, fingerprint or facial recognition
When a customer launches the app, they approve it with a username and password. There is no
Bharat QR Username and password 2) The app is launched
Harmonised other form of approval and the customer cannot choose.
specifications 1) The mobile device is *If the bill exceeds 1,000 yuan (~$150), the user will have to enter his password in the complete
HKQR Password or biometrics
unlocked transaction.

SGQR No mandatory requirements — SGQR has not provided any mandatory requirements for authentication.

QRIS No mandatory requirements x — QRIS has not provided any mandatory requirements for authentication.

The most common payment authentication methods have been passwords and fingerprints. Some
Alipay Password and biometrics 3) Before payment
devices support facial recognition that the user can choose.

WeChat Pay Password and biometrics 3) Before payment WeChat Pay requires the user to enter their payment password to confirm the transaction.

Proprietary Some companies let users use Face ID and fingerprints as an authentication method, but the
Prompt Pay Passwords 3) Before payment
specifications common authentication method is typing passwords before settlement.
The authentication method is typing a PIN before settlements. The user can change the
M-Pesa Passwords 3) Before payment
PIN on the M-Pesa app at any time.

Mercado Pago No mandatory requirements — Mercado Pago does not specify any mandatory requirements before or after settlement.

* Authentication is performed at 1) when the mobile device is unlocked, 2) when the app is launched, or 3) at the time of payment.
 A summary comparison of QR specifications across their 3 of 3 31

constituent components reveals many overlaps, but also

significant points of divergence
Summary: Analysis of the scope and coverage of the QR code data payload across the example specifications:

QR code data
Specification
Data for Merchant Presented Mode Data for Customer Presented Mode Data for linking up with different schemes*

EMV
Defined in the specification
JPQR Not defined in the specification
Defined in the specification
Bharat QR
Harmonised
Not defined in the specification
specifications
HKQR Defined in the specification

SGQR

QRIS
No published QR code data information
Alipay

WeChat Pay
Proprietary
Prompt Pay
specifications
M-Pesa Defined in the specification Not defined in the specification Not defined in the specification

Mercado Pago

* For a more detailed comparative analysis of different QR code technical specifications, refer to Appendix E.
** Columns of data are provided to work with each scheme, such as a “Reserve for EMVCo”
 A summary comparison of QR specifications across their  3 of 3 32

constituent components reveals many overlaps, but also

significant points of divergence
Summary: Analysis of the scope and coverage of the QR code data payload across the example specifications:

QR code data
Specification
Data for Merchant Presented Mode Data for Customer Presented Mode Data for linking up with different schemes*

Harmonised
specifications

Understanding the technical specifications of QR code

solutions is useful as they represent one of two possible
routes to interoperable QR code merchant payments.
Proprietary
specifications

* For a more detailed comparative analysis of different QR code technical specifications, refer to Appendix E.
** Columns of data are provided to work with each scheme, such as a “Reserve for EMVCo”
Charting a
course for • There appears to be a clear path for most QR
code merchant payment schemes around the

interoperable
world.

• As QR code merchant payments schemes

QR code
evolve, two primary dimensions of
interoperability are typically encountered:
domestic and cross-border.

merchant • There are two primary approaches to QR

code merchant payments interoperability:
payments harmonisation of QR code specifications
and harmonisation via API and/or back-end
integration.
 There appears to be a clear path for most QR code merchant payment 34

schemes around the world

There are many QR code payments initiatives

Maturity and sophistication

around the world, many of which are in DOMESTIC CROSS-BORDER
different stages of development and maturity. Government/regulator-led
Regardless of the stage, there appears to multilateral cross-border
interoperability
be a clear path for most QR code payment
schemes, with an important focus on
interoperability:

• Almost all schemes start with a domestic Government/regulator-led

agenda. bilateral cross-border
Government/regulator-led interoperability
• Initiatives evolve differently and follow domestic interoperability
Bilateral outbound/
different paths, but there is a clear progression inbound interoperability
from domestic to cross-border interoperability
over time (see adjacent diagram).
• In many cases, initiatives will not only follow Closed loop outbound/
inbound interoperability
different paths, but also appear to double
Provider
back as priorities change. consolidation
Joint venture/consortium
limited open loop scheme

Proprietary, closed
loop scheme

Elapsed time
 There appears to be a clear path for most QR code merchant payment 35

schemes around the world

Examples of some primary drivers that could influence the path to interoperability are: Progress towards interoperability
is seldom linear and encompasses
various dimensions. These will be
Business case priorities, e.g. domestic Government/regulatory intervention examined in the following sections.
payments agenda at the outset, with some (domestic), e.g. Government or regulator
changing to a cross-border agenda over taking an early lead to establish national
time. QR code payments schemes, or becoming
involved later to bring about market
Scaling, e.g. seeking options to scale the harmonisation. Government/regulator
capability of existing QR code payments involvement tends to focus initially on
via partnership(s), e.g. joint venture/ a domestic agenda primarily due to
consortium, etc. obligations to the national population.

Market efficiencies, e.g. seeking options Government/regulatory cross-border

to consolidate offerings within domestic support, e.g. where a significant proportion
markets, across or even outside regions. of the population will be well served
by a joined-up approach to payments
in territories where there is a mutual
government-to-government interest, such
as a major outbound tourist destination.
 As QR code payments schemes evolve, two key dimensions of 36

interoperability are typically encountered: domestic and cross-border

interoperability
The diagram Geographic focus Domestic interoperability Cross-border interoperability
alongside illustrates
the key dimensions Directionality One way vs Dual interoperability Inbound vs Outbound interoperability

of interoperability National initiatives/ National vs Proprietary scheme interoperability

and how they lead to Agreement
Bilaterals Multilaterals
National scheme
structures Proprietary scheme to National National scheme to Proprietary
different outcomes scheme scheme
based on the
strategic ambitions Harmonised QR code
Integration approach
and objectives of a Back-end API
scheme.
The different dimensions of domestic interoperability The different dimensions of cross-border interoperability
• One-way vs dual interoperability • Inbound vs outbound interoperability between proprietary schemes
i. One-way interoperability (e.g. Scheme A customers can transact with i. Inbound: e.g. Scheme A (e.g. in Japan) enables Scheme B’s customers
Scheme B merhants) (e.g. from China) to transact with it in Japan
ii. Dual interoperability (e.g. Scheme A customers and Scheme B ii. Outbound: e.g. Scheme D (e.g. in China) enables its customers to
customers can transact with Scheme A and B merchants) transact with Scheme E merchants (e.g. in Indonesia)
• Agreement structures • National scheme interoperability vs proprietary scheme interoperability
i. Bilaterals (i.e. proprietary scheme to proprietary scheme) i. Inbound and/or outbound interoperability is enabled via interoperability
Viewpoint ii. Multi-lateral agreements (i.e. JVs/consortium appraoch between between National Scheme J (e.g. in Japan) and proprietary Scheme C
multiple proprietary schemes) (e.g. from China)
iii. National initiatives (i.e. National scheme) ii. Inbound and/or outbound interoperability is enabled via interoperability
between National Scheme P (e.g. in Indonesia) and National Scheme Q
(In Thailand)

Two primary integration approaches to interoperability

1. Harmonised QR code specifications (i.e. interoperability enabled via front-end harmonisation
2. Integrated APIs with differing/proprietary QR code specifications (i.e. interoperability enabled via back-end integration, typically APIs)
 As QR code payments schemes evolve, two key dimensions of 37

interoperability are typically encountered: domestic and cross-border

interoperability
As schemes evolve and gain How to achieve these objectives:
scale, strategic ambitions will
Agreement structures
typically fuel a desire to scale
even further through some form – Bilateral versus multilateral at
of interoperability. proprietary or national levels

There are various dimensions • Integration approach

of interoperability, which are – Harmonised QR code versus
generally grouped into the back-end integration (typically
objectives being sought and how API)
to achieve those objectives.
This document will now focus on
Objectives: the technical aspects of achieving
• Geographic focus: interoperability, citing prominent
examples of implementation
– Domestic interoperability versus
approaches.
cross-border interoperability
• Directionality of interactions
– Inbound versus outbound
interoperability
 There are two primary approaches to QR code payments 38

interoperability: harmonisation of QR code specifications and

harmonisation via API and/or back-end integration
This diagram illustrates the two key
Merchant Payment routing
approaches to interoperability, highlighting the
Interoperability
differences between front-end (e.g. QR code) Proprietary
QR code processing
and back-end (API) harmonisation. It is harmonisation
important to note that: National switch(es)

• Interoperability schemes typically take Cross-border

Face-to-face switches
either a harmonised approach to QR code These examples implement the
EMV standard for MPM and CPM
specification OR involve some form of back- QR codes:
Interoperability
end integration via APIs.
API harmonisation
• Interoperability does not require both QR
Propietary
code harmonisation and API integration, QR codes
Online
i.e. interoperability can be achieved using only
one of these mechanisms.

Front-end Back-end
There are two primary approaches to QR code payments 39

interoperability: harmonisation of QR code specifications and

harmonisation via API and/or back-end integration

Harmonised QR code specifications API integrations

Proprietary Scheme A National Scheme A Proprietary Scheme A Proprietary Scheme A National Scheme A
Interoperability
approach Harmonised QR code Harmonised QR code A’s API or B’s API National Scheme B’s API NS A’s API or NS B’s API

Proprietary Scheme B National Scheme B Proprietary Scheme B National Scheme B National Scheme B

Harmonised QR code example: API example:

China UnionPay (CUP) customer travels to WeChat Pay customer travelling to Indonesia, using WeChat Pay to
Japan, using UnionPay at Japanese JPQR transact at QRIS enabled merchants in Indonesia.
merchants.

Proprietary Scheme A Proprietary Scheme A*

QRIS
Harmonised QR code National Scheme B’s API API

National Scheme B National Scheme B’s For more insights

Merchant acquirer
and examples of QR
National Scheme B QRIS code specification
merchants
harmonisation, see
Appendix D

* WeChat Pay in partnership with CIMB Niaga (using QRIS API). Similarly, Alipay has recently agreed to a deal with Indonesian state-owned banks, BRI and Bank Mandiri
Key trends, • There are many different approaches to the
adoption of QR code payments, and trends
and lessons can be drawn from existing
findings and deployments around the globe.

call to action
• Mobile money providers are actively
promoting the use of QR codes for
merchant payments in emerging markets,
but they must also lay the foundation for
interoperability.

• Call to action for mobile money providers

 TRENDS
As QR code merchant payments continue to grow in popularity,  1 of 2 41

it is important to recognise not only the material trends, but also

the impacts and implications of these trends

QR code merchant payments are not Government interest and intervention Smartphone penetration is increasing, but
new, and there is a significant body of is growing feature phone penetration remains high
global knowledge and experience from • Historically, governments and regulators have • Smartphones are essential to the success of
providers operating in this ecosystem shown little inclination to intervene in the QR code merchant payments. Smartphone
(with varying degrees of success). merchant payments segment. However, this penetration is high in many of the regions
Here, we examine some of the major appears to be changing around the world, where QR code merchant payments are
trends in QR code merchant payments particularly in developing regions where there popular (e.g. various Asian markets). However,
and their key impacts and implications. is a desire to reduce the use of cash and this is not the case in many other markets (e.g.
counterfeit. across Africa) where smartphone penetration
• Another key objective is to improve financial is growing, but very slowly, and feature phone
inclusion and literacy, which has fuelled efforts penetration remains high. In these regions, the
to increase the banked population. affordability of devices is a critical challenge.
Internet connectivity is required, but remains
a challenge for many • Regulators recognise that one way to achieve • Accelerating the penetration of affordable
these goals is to reduce the cost of non-cash smartphones is vital, and pursuing a ”bridge”
• Some form of internet connectivity is required smart feature phone platform in parallel, such
merchant payments to make digital payments
to support effective QR code merchant as KaiOS, may help mitigate this challenge.
more attractive.
payments. Although there continues to be a
keen interest in improving coverage, a number • States benefit from all of the above through
of regions still have limited or no coverage. enhanced money traceability and, therefore,
potentially higher tax revenues.
 TRENDS
As QR code merchant payments continue to grow in popularity,  2 of 2 42

it is important to recognise not only the material trends, but also

the impacts and implications of these trends
Interoperability is crucial at various stages • Alipay and WeChat Pay have also begun Biometric payments are becoming more
of the QR code merchant payments journey to open their ecosystem in China to those feasible
travelling to China, which could bolster their
• Various forms of interoperability become • Biometrics could ultimately replace QR codes
already dominant position.
crucial considerations at certain points in the (and other payment tokens).
QR code merchant payments journey. This Downward pressure on payment acceptance • Biometric payment methods are slowly
is rarely a consideration in the early stages, fees and costs gaining profile around the world. China leads
but becomes an important factor later. Late on this and could pave the way for biometrics,
consideration of this aspect can pose material • There is consistent downward pressure on such as fingerprint and/or facial recognition
challenges to scale and growth. the costs and fees associated with merchant
to replace payment tokens (e.g. QR codes)
payments acceptance, including POS
and their host devices (e.g. smartphones) for
Payment giants are continuing aggressive hardware. QR code merchant payments are
payments entirely.
global growth seen as a potential solution to this challenge,
particularly for micro-merchants. QR code merchant payments: an interim step
• Alipay and WeChat Pay continue to build on
their domestic success and are adopting a towards NFC payments?
Material difference in market approaches
flexible approach to cross-border acceptance • In some cases, QR code merchant payments
interoperability to ensure their customers are • There are existing and emerging material are seen as an interim step or bridge to NFC
supported when they travel. differences in market approaches to QR code
payments.
merchant payments across geographies
• This has effectively applied tacit pressure • Major international payments schemes see
(e.g. some are heavily regulator-led, others
on foreign bodies and value chain players the potential, but also recognise that this may
are fintech-led while others are MMP-led).
to enable interoperability in their domestic not be the path some (non-card dominated)
A one-size-fits-all approach is unlikely to be
markets for inbound Chinese travellers. regions will take.
successful.
 FINDINGS
Findings: there are many different approaches to adopting  1 of 2 43

QR code merchant payments, and lessons can be drawn from

deployments around the globe

The impact of these approaches will Key headline findings:

vary depending on where the provider
  Crucial enablers and interdependencies  Geographic nuances
is on its QR code merchant payments
journey. • Components of the ecosystem are heavily • A clear and deep knowledge of target
interdependent. As a crucial first step, it is markets is required, and a one-dimensional
important that target customers have easy, approach is unlikely to succeed. For example,
affordable access to appropriate devices, it is important to recognise that different
connectivity and bank accounts. However, it populations have different needs (e.g.
takes time for a market to shift from feature payments challenges in rural areas will be
phones to smartphones, as does convincing different from those experienced in cities) and
cash merchants to move to digital payments. markets with deep smartphone penetration
will behave differently from feature phone
  Evolutionary journey markets.
• It has been demonstrated repeatedly that
   Education and trust
there are key milestones along the QR code
merchant payments journey. These highlight • Ecosystem participants must have trust and
the evolving, non-linear nature of the journey, confidence in QR code ecosystems if they are
and may require backtracking to ultimately to thrive. Robust and continued education
gain forward momentum. of all stakeholders, especially merchants and
customers, is necessary to build and embed
trust. This can be achieved in a variety of
ways, such as promotions by large and trusted
retail brands, or enlisting government support
(where the government is a trusted entity).
 FINDINGS
Findings: there are many different approaches to adopting  2 of 2 44

QR code merchant payments, and lessons can be drawn from

deployments around the globe

Key headline findings cont.

  Regulatory intervention   Strategic objectives

• Increasing government and regulatory • Clear, concise and executable strategic • On their own, QR code merchant payments
appetite for intervention requires careful objectives are required throughout the journey, are typically a difficult financial proposition
consideration of their agenda and determining but these should be reviewed regularly and for providers. These payments should support
how to feasibly address these priorities in a recalibrated when required. For example, if the consumption of high-value products and
proposition. success is likely to depend on interoperability, services that are the core drivers of revenue
do not leave interoperability until the last and profitability.
  Distribution minute.
• Distribution is key. Ubiquitous merchant and • One of the main perceived benefits of QR
customer uptake is essential to the success of code merchant payments is the potentially low
these types of payments initiatives. Providers cost of entry and participation for merchants
will need to resolve the “catch-22” challenge and customers. It is important not to lose
of merchants waiting for customer demand sight of this to ensure that QR code merchant
before moving to support this demand, while payments remain the most compelling option
customers wait for their favourite merchants for stakeholders that place high value on
to support the scheme before signing up for it. affordability.
 CALL TO ACTION
Mobile money providers are actively promoting the use of QR codes 45

for merchant payments in emerging markets, but they must also lay
the foundation for interoperability
QR code merchant payments QR code merchant payments
have already been widely adopted are a complex proposition with
in specific markets like China, many moving parts in terms of
but are still in an early part of their product flow and technical
their journey in other parts of specifications, as shown in this
the world, particularly emerging report. It is important the mobile
markets. industry aligns on the specific
aspects of a QR code merchant
Mobile money providers are key
payment solution to achieve
players in the provision of financial
a harmonised experience for
services in emerging markets and
customers across providers.
are actively promoting the use of
QR codes for merchant payments To enable this, the mobile money
there. industry may consider adopting
an existent harmonised QR code
They can leverage their leading
specification that meets its needs
position in these markets
or developing a bespoke new
to capture the opportunity
one that is tailor‑made to address
presented by QR code merchant
its requirements.
payments, but should adopt the
lessons emerging from other QR
code deployments globally.
Conclusion

QR code merchant payments present a Non-telco players are already investing

significant growth opportunity for mobile heavily in this opportunity.
money providers.
There is currently an early-mover
Longer term, sustainable growth will be opportunity for the industry. This window
underpinned by the industry’s willingness to of opportunity will not remain open
collaborate. indefinitely.
Join the conversation

Twitter Facebook LinkedIn Web

@GSMAMobileMoney GSMA Mobile for GSMA Mobile Money www.gsma.com/

Development (Group) mobilemoney

www.gsma.com/lab
 48

For more information on

GSMA Mobile Money,
visit gsma.com/mobilemoney

GSMA Head Office

Floor 2
The Walbrook Building
25 Walbrook
London EC4N 8AF
United Kingdom
Tel: +44 (0)20 7356 0600
Fax: +44 (0)20 7356 0601
Appendices A
General

Glossary of terms H
QR code trends in leading markets

What can we learn from China and other

parts of the world?
B List of interview participants
I Facial recognition technology and its
A deep dive into QR code technology impact on QR codes in China

C Push versus pull payments: technical flows J Emerging QR code merchant payments:
examples from Latin America
D QR code merchant payments: technical
component analysis
QR code implementation
E Comparisons of QR code specifications:
K Scheme specification design and
select examples
implementation process
F QR code merchant payments API
L Optimising implementation of QR code
component analysis
merchant payments
G QR code merchant payments: device
M Security and risk management
affordability
Appendix A
Glossary of terms
 Glossary of terms 51

Element Parameter Description

Comms channel Internet connectivity TCP/IP-based internet connection
USSD connectivity USSD (Unstructured Supplementary Service Data) is a communications protocol used by GSM cellular
telephones to communicate with the mobile network operator's computers. USSD messages are up to
182 alphanumeric characters long.
Device Smartphone Smartphones are a class of mobile phones and multipurpose mobile computing devices with touch screens.
Smart feature phone A smart feature phone is between a smartphone and a feature phone. It has a simple OS and a larger display
than a feature phone, and supports basic applications such as social media and messaging.
Feature phone Feature phones are mobile phones that retain the form factor of early-generation phones, with button-based
input and a small display.
QR code Merchant-presented “Merchant presented” is a style in which the QR code is displayed on the merchant side and scanned by the
presentment mode (MPM) customer.
Customer-presented “Customer presented” is a style in which the QR code is displyed on the customer side and scanned by the
mode (CPM) merchant.
Payment type Push payments Push payments rely on customers actively sending or “pushing” money to the merchant. The merchant
requests the payment and then relies on their customer to send the amount owed.
Pull payments Pull payments allow the merchant to “block” or ”pull” money from customers, providing there is a pre-existing
agreement between both. In this way, the merchant has greater control over cash collection.
 Glossary of terms 52

Element Parameter Description

QR code type Static QR code “Static” is a fixed, unchangeable QR code. In this type of QR code,
the payments transaction payload is placed directly in the QR code
Dynamic QR code A dynamic QR code and its underlying data change depending on the transaction. In addition to payments,
this code can also be used for access management, password protection, scan analysis and device-based
redirection.
Merchant Merchant online A situation in which the merchant system is connected to the internet.
connectivity Merchant offline A situation in which the merchant system is not connected to the internet.
Customer Customer online A situation in which the customer device is connected to the internet.
connectivity Customer offline A situation in which the customer device is not connected to the internet.
Transaction PIN Authentication using numbers.
authentication Password Authentication using secret authentication information such as numbers and text
Biometric An authentication technology that uses biometric information such as fingerprints and facial recognition.
Transaction Face-to-face Represents in-store payments.
channel Remote/ A situation in which a payment is made via remote digital channels.
E‑commerce
Appendix B
List of interview participants
 List of interview participants 54

Organisation Organisation Type Regional scope

Denso Inventor of QR codes China, Global
MTN MNO, QR code payments player Middle East, Africa
Orange MNO, QR code payments player Middle East, Africa
Vodafone MNO, QR code payments player Middle East, Africa, Global
Telenor Easypaisa MNO, QR code payments player Pakistan
NTT DOCOMO MNO, QR code payments player Global
Bank of Ghana Central bank, regulator Ghana
Bank Indonesia Central bank, regulator Indonesia
Bank of Thailand Central bank, regulator Thailand
National Payments Corporation of India (NPCI) National payments industry body and infrastructure operator India
Payments Japan Association National standards body Japan
Asian Payments Network Cross-regional standards body Asia
KaiOS Device OS (smart feature phones) Global
PalmPay Fintech, QR code payments player Africa
GoPay Fintech, QR code payments player Southeast Asia
 List of interview participants 55

Organisation Organisation Type Regional scope

Bluecode, EMPSA Fintech, QR code payments player, harmonisation organisation Europe
CIMB NIAGA Bank, QR code payments player Southeast Asia
Visa International payments player Global
Mastercard International payments player Global
RPC (International law firm) Payments, regulatory and legal Global
Accourt Global payments advisory Global
NTT Data Global technology organisation Global
Appendix C
Push versus pull payments:
technical flows
 Push versus pull payments: technical flows 57

Push payments Push payments — Merchant-presented Mode (MPM) Pull payments

0 Static/dynamic QR code 0 Static/dynamic QR code
Payment scheme
presented by merchant presented by customer
The following diagrams 1  ustomer opens app, authenticates
C 1 Merchant scans QR code
provide a brief, high-level (if required) and scans QR code 3 4
2 Merchant requests payment
summary of two primary 2 Customer authorises the transaction authorisation against customer’s
Customer’s
approaches to executing account/ Merchant
account via merchant acquirer
3 Customer’s account provider routes app provider acquirer
and processing QR code
payment instruction from customer 3 Merchant acquirer routes
merchant payments.
to payment scheme, funds are 2 5 authorisation request to payment
settled to the acquirer’s account* scheme, which routes it to the
1
QR code 0
4 Merchant acquirer receives payment Customer
(MPM)
Merchant
customer’s account provider
instruction 6 (e.g. Mobile Wallet/bank account)

5 Merchant acquirer makes payment* 4 Customers account provider

Pull payments — Customer-presented Mode (CPM)
into merchant’s account authorises or rejects the payment
authorisation and routes it back to
6 Merchant receives payment Payment scheme
the merchant via the acquirer
confirmation and funds;* hands
goods to the customer 5 The merchant receives payment
6 4 3 3 4 6
authorisation; hands goods to the
Customer’s
customer
account/ Merchant
app provider acquirer 6 Payment Scheme facilitates payment
from the customer’s account to the
3 2 4 6 merchant’s account via the merchant
*Note: this example illustrates a push payment in an
immediate payments ecosystem. Some payments may acquirer (this settlement can happen
0
QR code 1
take longer to reach the acquirer and the merchant.
Customer
(CPM)
Merchant
any time between 1 and 60 days after
5 the transaction)
Appendix D
QR code merchant payments:
technical component analysis
 Insights: QR code specification harmonisation 1 of 2 59

The EMV specifications are the only International interoperability

harmonised QR code specifications
Not supported Supported
currently, and several schemes have
either elected to design to these Since there are few domestic payment
Easypaisa is dominant in the QR code

Not supported
specifications from the outset or schemes and many visitors come from
payments market in Pakistan and there
reverse-engineer harmonisation with overseas, and many people work in
is therefore no rationale curently to work
neighbouring countries, the government

Domesitc interoperability
EMV at a later stage. Few schemes with other schemes, either domestically
is considering working with overseas
or internationally (unless compelled to
implement the EMV specifications schemes in parallel with domestic
do so by the Regulator).
verbatim, as these schemes have standardisation.
different characteristics and features
they wish to support, depending on
the country and regional context of They are not active in working with
There is a great deal of coordination

Supported
foreigh countries and they are focused
the specification. Some examples of between domestic and international
on aligning with domestic schemes.
payment schemes with QR codes, which
these dimensions and rationale are Because the size of the domestic
suggests they want this coordination to
illustrated below. economy is so large and the economy
add value.
schemes are too many.

The insights were derived primarily based on the QR Code Elements analysis.
Refer to Appendix E for more information.
 Insights: QR code specification harmonisation 2 of 2 60

As an example of the QR code

harmonisation approach, the Hong
Kong Monetary Authority (HKMA) is
linked to both domestic and foreign
schemes. The Myanmar Payment
Union (MPU) has few domestic
schemes, so is working with other
overseas schemes. Different
strategic drivers therefore influence
approaches to harmonisation and
interoperability.

Domestic scheme Chinese scheme* International scheme Domestic scheme International scheme

* Initiative led by the Central Bank of Myanmar to enable domestic acceptance, via local banks, for inbound Chinese tourists using Alipay and WeChatPay
** M-Pitesan by Ooredoo in Myanmar
Appendix E
Comparisons of QR code
specifications: select examples
 Comparisons of harmonised QR code specifications 1 of 4 62

A comparison of the QR code data elements of each scheme using the EMV specification as the base:
QR code data MPM CPM
# Category Data elements EMV JPQR HKMA Easypaisa Jordan EMV JPQR
1 Customer Mobile Number
2 elements Reference Label
3 Customer Label
4 Additional Consumer Data Request
5 Application Dedicated File (ADF) Name
6 Application Label
7 Application PAN
8 Application Specific Transparent Template
9 Application Template
10 Application Version Number
11 Language Preference
12 Application Definition File (ADF)Name)
13 Payment Account Reference
14 Cardholder Name
15 Loyalty Number
16 Merchant Terminal Label
17 elements Country Code
18 Merchant Name
19 Merchant City
20 Postal Code
 Comparisons of harmonised QR code specifications 2 of 4 63

A comparison of the QR code data elements of each scheme using the EMV specification as the base:
QR code data MPM CPM
# Category Data elements EMV JPQR HKMA Easypaisa Jordan EMV JPQR
21 Merchant Merchant Category Code
22 elements Merchant Information - Language Template
23 Merchant Name - Alternate Language
24 Merchant City - Alternate Language
25 Merchant Account Information
26 Store Label
27 Payment system operators
28 Merchant Payment Address
29 Geographical Location
30 Merchant Tax ID
31 Merchant Channel
32 Transaction Transaction Currency
33 elements Transaction Amount
34 Point of Initiation Method
35 Bill Number
36 Purpose of Transaction
37 Common Data Transparent Template
38 Token Requestor ID
39 Tip or Convenience Indicator
40 Value of Convenience Fee Fixed
 Comparisons of harmonised QR code specifications 3 of 4 64

A comparison of the QR code data elements of each scheme using the EMV specification as the base:
QR code data MPM CPM
# Category Data elements EMV JPQR HKMA Easypaisa Jordan EMV JPQR
41 Transaction Value of Convenience Fee Percentage
42 elements Date and Time
43 Rewards or equivalent
44 Scheme Payload Format Indicator
45 elements Payment network specific
46 Issuer URL
47 Globally Unique Identifier
48 Interoperability Reserved for Visa
49 support Reserved for Mastercard
50 elements Reserved by EMVCo
51 Reserved for Discover
52 Reserved for Amex
53 Reserved for JCB
54 Reserved for UnionPay
55 Reserved for the FasterPayment System for use in Hong Kong
56 Reserved by the WG for use in Hong Kong
57 Reserved for payment operators for use in Hong Kong
58 Reserved for EMVCo
59 Reserved for FPS
60 Reserved for the WG
 Comparisons of harmonised QR code specifications 4 of 4 65

A comparison of the QR code data elements of each scheme using the EMV specification as the base:
QR code data MPM CPM
# Category Data elements EMV JPQR HKMA Easypaisa Jordan EMV JPQR
61 Interoperability Reserved for Hong Kong
62 support RFU(Reserved for Future Use) for EMVCo
63 elements Reserved for Jordan Payment Switches
64 Transaction Cyclic Redundancy Check (CRC)
integrity
elements
65 Uncategorisable Other template
66 Additional Data Field Template
67 Common Data Template
68 Unreserved Templates
69 Last 4 Digits of PAN
70 Track 2 Equivalent Data
 EMV Specification – MPM 66

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Language Preference • Terminal Label • Merchant City – Alternate • Transaction Currency • Bill Number
• Country Code Language • Transaction Amount • Mobile Number
• Merchant Name • Merchant Account • Point of Initiation Method • Store Label
Information
• Merchant City • Tip or Convenience • Reference Label
• Store Label Indicator
• Postal Code • Customer Label
• Merchant Category Code • Value of Convenience Fee • Purpose of Transaction
– Fixed
• Merchant Information – • Additional Consumer
Language Template • Value of Convenience Fee Data Request
– Percentage
• Merchant Name –
Alternate Language

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • RFU (reserved for future use) for EMVCo • Cyclic Redundancy Check • Additional Data Field
Indicator (CRC) Template
• Globally Unique • Unreserved Templates
Identifier
 Easypaisa Specification – MPM 67

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Language Preference • Terminal Label • Merchant City – Alternate • Transaction Currency • Bill Number
• Country Code Language • Transaction Amount • Mobile Number
• Merchant Name • Merchant Account • Point of Initiation Method • Store Label
Information
• Merchant City • Tip or Convenience • Reference Label
• Store Label Indicator
• Postal Code • Customer Label
• Merchant Category Code • Value of Convenience Fee • Purpose of Transaction
– Fixed
• Merchant Information – • Additional Consumer
Language Template • Value of Convenience Fee Data Request
– Percentage
• Merchant Name –
Alternate Language

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • RFU (reserved for future • Cyclic Redundancy Check • Additional Data Field
Indicator use) for EMVCo (CRC) Template
• Globally Unique • Unreserved Templates
Identifier
 JPQR Specification – MPM 68

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Language Preference • Terminal Label • Merchant City – Alternate • Transaction Currency • Value of Convenience Fee • Bill Number
• Country Code Language • Transaction Amount – Percentage • Mobile Number
• Merchant Name • Merchant Account • Point of Initiation Method • Store Label
Information
• Merchant City • Bill Number • Reference Label
• Store Label
• Postal Code • Purpose of Transaction • Customer Label
• Merchant Category Code • Tip or Convenience • Purpose of Transaction
• Merchant Information – Indicator • Additional Consumer
Language Template • Value of Convenience Fee Data Request
• Merchant Name – – Fixed
Alternate Language

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • RFU (reserved for future use) for EMVCo • Cyclic Redundancy Check • Additional Data Field
Indicator (CRC) Template
• Globally Unique • Unreserved Templates
Identifier
 SGQR Specification – MPM 69

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Language Preference • Terminal Label • Merchant City – Alternate • Transaction Currency • Bill Number
• Country Code Language • Transaction Amount • Mobile Number
• Merchant Name • Merchant Account • Point of Initiation Method • Store Label
Information
• Merchant City • Tip or Convenience • Reference Label
• Store Label Indicator
• Postal Code • Customer Label
• Merchant Category Code • Value of Convenience Fee • Purpose of Transaction
– Fixed
• Merchant Information – • Additional Consumer
Language Template • Value of Convenience Fee Data Request
– Percentage
• Merchant Name – • Loyalty Number
Alternate Language

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • RFU(Reserved for • Ezi-Wallet • Cyclic Redundancy Check • Additional Data Field
Indicator future use) for EMVCo (CRC) Template
• Globally Unique • VISA ID • Unreserved Templates
Identifier • Mastercard ID
• SGQR ID • Amex ID
• SGQR ID number • UnionPay ID
• Version • Singtel Dash
• Miscellaneous • LiquidPay
• New version date • OCBC

Bold text indicates differences between elements across specifications

 Hong Kong Monetary Authority (HKMA) – MPM 70

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Language Preference • Terminal Label • Merchant City – Alternate • Transaction Currency • Bill Number
• Country Code Language • Transaction Amount • Mobile Number
• Merchant Name • Payment System • Point of Initiation Method • Store Label
Operators
• Merchant City • Tip or Convenience • Reference Label
• Postal Code Indicator • Customer Label
• Merchant Category Code • Value of Convenience Fee • Purpose of Transaction
– Fixed
• Merchant Information – • Additional Consumer
Language Template • Value of Convenience Fee Data Request
– Percentage
• Merchant Name – • Loyalty Number
Alternate Language

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • Reserved for Visa • Reserved by the WG for • Cyclic Redundancy Check
Indicator • Reserved for Mastercard use in Hong Kong (CRC)
• Payment Network • Reserved by EMVCo • Reserved for payment
Specific operators for use in
• Reserved for Discover
• Globally Unique Hong Kong
• Reserved for Amex
Identifier
• Reserved for JCB
• Reserved for UnionPay
• Reserved for the
FasterPayment System
for use in Hong Kong

• HKMA was designed with interoperability with other payment methods in mind.
• It was and is a cards-centric territory and therefore requires advanced features
• It’s a small country with a lot of travel to and from other countries.
 JOPACC Specification – MPM 71

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Language Preference • Terminal Label • Store Label • Transaction Currency • Reference Label
• Country Code • Merchant Payment • Transaction Amount • Customer Label
• Merchant Name Address • Point of Initiation Method • Bill Number
• Merchant City • Geographical Location • Tip or Convenience • Purpose of Transaction
• Postal Code • Merchant Tax ID Indicator
• Merchant Category Code • Merchant Channel • Value of Convenience Fee
– Fixed
• Merchant Name –
Alternate Language • Value of Convenience Fee
– Percentage
• Merchant City – Alternate
Language • Date and Time

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • Reserved for Visa • Reserved for Jordan • Cyclic Redundancy Check
Indicator • Reserved for Mastercard Payment Switches (CRC)
• Payment Network- • Reserved by EMVCo • Additional Data Field
Specific Template
• Reserved for Discover
• Globally Unique
• Reserved for Amex
Identifier
• Reserved for JCB
• Reserved for UnionPay
• RFU (Reserved for Future
Use) for EMVCo

• Jordan was designed with interoperability with other payment methods in mind.
• Merchant information specific to Jordan is specified in the QR code.
 EMV Specification – CPM 72

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Application Dedicated • Payment Account • Common Data • Reference label
File (ADF) Name Reference Transparent Template • Customer label
• Application Label • Cardholder Name • Token Requestor ID • Bill number
• Application PAN • Application Definition File • Purpose of transaction
• Application Specific (ADF) Name)
Transparent Template
• Application Template
• Application Version
Number

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • Common Data Template
Indicator • Last 4 Digits of PAN
• Issuer URL • Track 2 Equivalent Data
 JPQR Specification – CPM 73

The elements of QR code merchant payments data are categorised as follows:

Rewards or
Customer elements Merchant elements Transaction elements
equivalent elements
• Application Dedicated • Payment Account • Common Data • Reference label
File (ADF) Name Reference Transparent Template • Customer label
• Application Label • Cardholder Name • Token Requestor ID • Bill number
• Application PAN • Application Definition File • Purpose of transaction
• Application Specific (ADF) Name)
Transparent Template
• Application Template
• Application Version
Number

Interoperability Transaction integrity

Scheme elements No category
support elements elements
• Payload Format • Common Data Template
Indicator • Last 4 Digits of PAN
• Issuer URL • Track 2 Equivalent Data
Appendix F
QR code merchant payments
API component analysis:
— API scope
— Transaction support comparison
 QR code merchant payments – API scope 75

Summary: Analysis of the scope and coverage of the example API specifications in support of QR code merchant payments

API specification’
Specification
API for domestic merchant* API for overseas merchant** API for bank or issuer

EMV

JPQR Public Not public Not public

Bharat QR
Harmonised
specifications
HKQR

SGQR No published API specifications

QRIS

Alipay
Public
WeChat Pay Not public
Proprietary
specifications
Prompt Pay Public
M-Pesa Not public
Public
Mercado Pago

* APIs that can be used by merchants in domestic markets

** APIs that can be used by merchants in foreign countries
 Schemes offer a comparable core suite of transaction APIs 76

Summary: Although the API suites are comparable, they vary in complexity and depth of features.

# API name Alipay Pay WeChat Pay JPQR Bharat QR PromptPay

1 Payment

2 Cancel

3 Modify

4 Refund

5 Query status

6 Register

7 Download Reconciliation File API

8 For money transfer

9 Payment credit times

10 Static QR

11 Payment Notification

12 single_trade_query

13 Notify Verify

14 Connect to the Merchant System

15 Short URL Conversion

16 Report Speed Testing

17 Query Exchange Rate

Appendix G
QR code merchant payments:
device affordability
 QR code merchant payments: device affordability 78

QR code payments are highly dependent on

device capabilities, which makes affordable
devices crucial.

While smartphone penetration is relatively

good in some regions, in others, such as
Africa, feature phones still dominate and
smartphone penetration remains extremely
low (despite MNO efforts to incentivise
smartphone ownership).

Smart feature phones are emerging as an

affordable “bridge” technology that can
support QR code merchant payments.
Feature phones Smart feature phones Smartphones
OS RTOS KaiOS Android, iOS, Harmony OS
2G $7–$170 n/a n/a
2.5G $9–$190 $12–$45 n/a
Generation and
3G $10–$270 $14–$120 $25–$1,000+
price bracket
4G $17–370 $18–$190 $32–$1,000+
5G n/a n/a $320–$1,000+

* Prices in USD. Sources: KaiOS, IDC, 2020

Appendix H
What can we learn from China
and other parts of the world?
 What is driving QR code merchant payments worldwide? 1 of 3 80

While there are many common drivers, some Primary objectives of QR code Primary objectives of
are unique to certain ecosystems and shaped scheme providers: governments/regulators:
by the primary objectives of key stakeholders.
• To expand and further monetise mobile wallet • To reduce the use of cash and counterfeiting;
services with merchant payments services; • To drive financial inclusion and literacy (and
• To leverage QR code merchant payments as a increase the banked population);
lower cost alternative to incumbent payment • To reduce the cost of non-cash merchant
methods (attracting micro/informal merchants payments;
to digital payments);
• To enhance traceability and generate
• To use data from merchant payments to potentially higher tax revenues;
provide other products and services as
• To avoid the proliferation of disparate and
incremental revenue opportunities; and
fragmented national payments schemes; and
• To support financial inclusion agendas.
• To leverage investment in instant direct-to-
bank payments (i.e. non-card).
 What is driving QR code merchant payments worldwide? 2 of 3 81

Mature Asian markets: Japan, Korea, Developing Asian markets: India,

China
Taiwan, Hong Kong Indonesia, other Southeast Asian countries
China’s sophisticated payments giants High levels of bank account penetration and High levels of cash penetration have
originally developed to support already sophisticated digital societies have been galvanised a more proactive approach by
successful customer ecosystems. QR code crucial to creating momentum for QR code regulators in these countries. Impressive levels
merchant payments were developed in merchant payments in these markets. The of investment funding (e.g. private equity)
support of these digital ecosystems rather focus has typically been servicing payments have also accelerated the pace of fintech
than as a primary strategy. After years of for micro-merchants, but this gathering development. Many are adopting a copycat
keeping its distance, the regulator has begun momentum has prompted regulators (e.g. approach to the Chinese payments giants,
to intervene in these schemes. The regulator’s China) to support domestic harmonisation and high levels of smartphone penetration
main interest appears to be in the traceability and, in some cases, support for inbound continue to support the growth of QR code
of transaction funds and interoperability. travellers from other countries and schemes. merchant payments. Interoperability is
While Japan, Korea and Taiwan have domestically focused, but with pockets of
Key examples: Alipay, WeChat Pay, UnionPay maintained a domestic focus, Hong Kong support for inbound travellers. India is in a
Mobile QuickPass See the section dedicated to this and Singapore, with their relatively small unique position with extremely high levels of
market.
populations and high levels of inbound bank account penetration that can support
travellers, have a more international focus. uptake.

Key examples (national): JPQR, HKQR, SGKR Key examples (national): Bharat QR, QRIS,
Thai QR Payment
Key examples (proprietary): R Pay, d payment
Key examples (proprietary): GrabPay, OVO, GoPay,
Paytm
 What is driving QR code merchant payments worldwide? 3 of 3 82

Africa Latin America UK and Europe

Like Southeast Asia, African countries are Latin American countries have fragmented Like the US, the UK and Europe continue to
dominated by cash and extremely fragmented approaches to payments, although cards and be heavily dominated by payment cards and
in their approach to QR code merchant some localised methods (e.g. Boleto in Brazil) NFC, with many digital wallets also operating
payments. Unlike Southeast Asia, however, have emerged. QR code merchant payments on card “rails”. Traditional card ecosystem
African countries have relatively low levels of are starting to gain renewed momentum, led players are now moving to support steadily
smartphone and bank account penetration, primarily by MercadoLibre’s Mercado Pago, growing demand for QR code merchant
which has a severe impact on the growth of which has been dominant for some time, payments, primarily from Chinese tourists.
QR code merchant payments. Large mobile and PayPal. There is also a growing desire by PayPal has also recently extended its QR code
money providers, such as MTN, Orange and governments in the region to drive down the merchant solution to 28 countries across
Vodafone, have typically led key merchant use of cash due to the risks associated with several continents. Interoperability initiatives
payments initiatives, with ever-increasing, yet carrying it. Perhaps Brazil’s new regulator-led for QR code merchant payments have been
fragmented attention from central banks and PIX initiative will galvanise involvement by limited, however, EMPSA is well represented
regulators. regulators in other Latin American countries. in Europe and leads the European
interoperability agenda.
Key examples (national): GhQR Key examples (national): PIX (Brazil)
Key examples (national): EMPSA
Key examples (proprietary): MTN MoMo, Orange Key examples (proprietary): Mercado Pago, PayPal
Money, M-Pesa, Mowali (JV), SnapScan, PalmPay Key examples (proprietary): PayPal, Pingit,
Starbucks
 Two Chinese payments giants dominate 83

There are not yet many truly global QR code merchant payments schemes. China’s two payments giants, Alipay and WeChat Pay, are leading
examples of schemes that have dominated a domestic market and then moved to expand their acceptance beyond these borders, primarily with
a “follow their customers” approach and providing payments acceptance in outbound markets.

China’s two QR code payments giants, Alipay and WeChat Pay, These two players are leading the global expansion of QR code merchant
lead other global players by a significant margin payments, with international acceptance rates continuing to grow
 What can we learn from China?     1 of 5 MARKET HIGHLIGHTS
84

The world’s QR code merchant payments ecosystem is

dominated by two Chinese players, Alipay and WeChat Pay. Chinese population 1.4 bn (2020)

Annual mobile
> $41 tn (2019)
payments in China
Origins of Alipay and WeChat Pay Total non-B2B digital
$1.9 tn (2020)
transaction value
Owned by Alibaba Group and Tencent,
Alipay and WeChat Pay respectively are mode (CPM) of QR code dominates in China Chinese payment cards
7.6 bn (2019)
digital wallets embedded as smartphone today, but QR code stickers are still used by (6.9 bn debit; 686 m credit)
apps within their respective, highly successful micro-merchants in merchant-presented mode Alipay users
non-payment ecosystems. Alipay launched (MPM), whereby a customer opens their Alipay 1.2 bn (2020)
(launched 2009)
initially to support payments in the Alibaba or WeChat Pay app and scans the merchant’s
WeChat Pay users
marketplace (similar to Amazon), whereas QR code sticker. 1.0 bn (2020)
(launched 2013)
WeChat Pay launched initially to support
Until recently, use of these two “super apps”
sending of ‘red envelopes/packets’ in the Approx. 70% of users use both Alipay
has been limited to Chinese citizens. People
WeChat social media ecosystem (similar to and WeChat Pay (2019)
travelling to and within China could not use
Facebook/Whatsapp). Over 90% of people in China’s largest cities use
these wallets as a Chinese bank account and/
Today, most Chinese users have both apps and or credit or debit card was a prerequisite for WeChat Pay and  Alipay as their primary payment
can transfer funds into these wallets and use registration. In late 2019, however, both Alipay method, with cash second and  card-based debit/
these funds to pay others, including retailers, (via TourPass) and WeChat Pay enabled credit a distant third (card products in China are 
online or in-store. Alternatively, users can link travellers to sign up with their own bank/card dominated by China UnionPay).
their bank account or credit/debit card to the details and use the international versions of Over 92% of mobile payments in China are made
wallet and pay direct, i.e. without pre-loading their apps in China. Alipay requires travellers over Alipay and WeChat Pay.
their digital wallet with funds. Users typically to preload funds into the wallet, whereas
Alipay connects over a million restaurants, 40,000
present a dynamically generated QR code to WeChat Pay supports a direct link to the user’s
supermarkets and convenience stores, a million
the retailer who scans the code to initiate the credit or debit card without having to preload
taxis and 300 hospitals.
payment transaction. This customer-presented the wallet prior to transacting.
 What can we learn from China?      2 of 5 85

The world’s QR code merchant payments ecosystem is

dominated by two Chinese players, Alipay and WeChat Pay.

The foundation of this success story Consolidating and accelerating uptake

At launch, several market characteristics Given the favourable market factors and early • Low cost fee structures for merchants with
provided the foundation for successful market signs of success, both Alipay and WeChat no customer transaction costs when they
entry and growth: Pay were keen to press their advantage and transact within the wallet ecosystem.
focused on several key drivers: • Leveraging loyalty rewards to shift spending
• A high level of bank account ownership
(around 79 per cent of the Chinese • Developing and continually enhancing a away from cash. In many cases, the preferred
population); compelling value proposition by offering a payment option had always been cash.

• Very high levels of smartphone penetration range of useful services to both customers • Adopting a long-term view of profitability.
and customer engagement in the app and merchants. (Initially, merchants were Payments are not the core product, rather,
economy; incentivised by the providers to accept payments support ecosystems of customer
payments from their wallets, but these were value, which in turn drive profitability.
• Excellent mobile internet access, especially in
phased out as customers began driving
cities where Alipay’s and WeChat Pay’s largest
demand and merchants followed.)
customer bases live;
• Reducing on-boarding friction with self-
• High levels of both base literacy and financial
enrolment for both customers and merchants,
literacy; and
enabling transaction acceptance almost
• Merchants that did not like card payments. immediately.
• Reducing transaction friction by using QR
codes and highly responsive interfaces.
 What can we learn from China?      3 of 5 86

The world’s QR code merchant payments ecosystem is

dominated by two Chinese players, Alipay and WeChat Pay.

Arguably, the most important success factor was that both Alipay and WeChat Pay were developed to support already successful ecosystems
with extremely large and highly engaged customer bases. These digital wallets therefore enabled Alibaba Group and Tencent to further monetise
these ecosystems.

Low/no-cost model Domestic and international interoperability

Both players recognised the opportunity to Since these ecosystems have developed in popular Chinese destination markets, such
incentivise customers and merchants to retain largely in competition with each other, there as Japan, Thailand, South Korea, Australia, the
funds within their respective digital wallet has been a limited focus on interoperability. If United States and Singapore.
ecosystems, hence the emergence of “free” customers and merchants want to transact in
A two-prong strategy to cross-border
transactions for customers (unless they were both ecosystems, they must have both apps
expansion is evident in this mature market,
transferring funds out of the ecosystem, for and connectivity to both. Customers have
with both players appearing willing to work
example, to their bank account) coupled learned this easily and adopted this behaviour.
with incumbents, such as acquirers, schemes
with very low transaction fee structures for
National regulators are also beginning to drive and central regulators. In developing markets,
merchants. For example:
domestic interoperability initiatives (see the meanwhile, players are seeking to make
following regulatory section). Recently, Alipay strategic investments in promising fintech and
and WeChat Pay have adopted a “follow- payments organisations (there are exceptions,
Customer
free free free
the-customer” strategy for cross-border such as Tencent recently taking a stake in N26,
transaction fees
expansion, actively working towards cross- a German neo-bank).
Customer fee RMB RMB border acceptance of digital wallet payments
n/a
threshold* 20,000 10,000
Merchant
around 0.6% (f2f)
transaction fees**
 What can we learn from China?      4 of 5 87

The world’s QR code merchant payments ecosystem is

dominated by two Chinese players, Alipay and WeChat Pay.

Regulatory influences JD.com), Bestpay, 99bill.com, YQB.com and Bank of China, China UnionPay, Bank of
Ping An Insurance. Communications, Construction Bank and
Until relatively recently, the primary regulator
others.
in China, the People’s Bank of China (PBoC), In late 2019, Alipay and WeChat Pay complied
has had little inclination to become involved in with the regulator’s requirement, and 100 per
What’s next for China’s payment giants?
Alipay’s or WeChat Pay’s affairs. However, in cent of their transactions with bank accounts
2017 this began to change when the regulator and credit/debit card accounts are now routed It appears that the cross-border expansion
became concerned about a lack of oversight and processed through Wanglian. However, a remains high on the agendas of both players.
of the huge volumes of transactions being significant amount of payments are still traffic This is accompanied by a relatively new goal
conducted within these two ecosystems. This routed within the Alipay and WeChat Pay to support travellers both to and within China,
concern precipitated the PBoC’s Wanglian ecosystems, not via Wanglian. which is only expected to gain in strength.
initiative, which required non-bank institutions
Another material intervention by the regulator Domestically, there appears to be a clear split
such as Alipay and WeChat Pay to process
came with the release of the Fintech between a compulsory regulatory agenda and
their transactions via a central entity.
Development Plan (2019–2021) in September a more commercially driven set of product
The Nets Union Clearing Corporation 2019, which identified compatible and and service enhancements.
(NUCC) or Wanglian (loosely translated as interoperable QR code merchant payments
“non-bank internet payments union”) is 37 as a key objective. The aim is mutual scanning
per cent owned by PBoC and its subsidiaries. and recognition of all QR codes in the
Alipay and Tencent both own 9.61 per Chinese payments market, i.e. compatibility
cent of Wanglian. Other private company and interoperability across all vendors and
shareholders with smaller equity positions apps. This process has already begun with
include Chinabank Payment (owned by various trials involving Alipay, WeChat Pay,
 What can we learn from China?      5 of 5 88

The world’s QR code merchant payments ecosystem is

dominated by two Chinese players, Alipay and WeChat Pay.

The regulator’s focus on additional Two other interesting initiatives: Regardless of their focus areas and an ever-
oversight and insight into formerly “black encroaching regulatory agenda, Alipay and
Greater rural penetration – While both
box” ecosystems is expected to continue, WeChat Pay seem keenly positioned to
Alipay and WeChat Pay enjoy significant user
supported by an implementation agenda. continue dominating digital payments in China
penetration and engagement in Chinese cities,
Domestic interoperability is also expected to and possibly even globally. Some expect QR
engaging with rural communities remains a
gain momentum from this regulatory push. codes to eventually disappear in favour of
challenge. Data connectivity and lack of bank
The regulator appears to be increasingly facial recognition, but privacy concerns in
accounts tend to call into question the need
interested in risk and dispute management China, and especially in major international
and usefulness of digital wallets and services
within these ecosystems. markets, may slow this transition dramatically.
in general.
A relatively new, but extremely high-profile
Facial recognition payments – Both Alipay
item on China’s regulatory agenda is the
and WeChat Pay are pushing their respective
Central Bank Digital Currency (or Digital
facial recognition payments agendas. Crucially,
Currency Electronic Payment/DCEP), which
their approach is centred on the customer’s
will undoubtedly have an impact on both
face being the payment token, which means
Alipay and WeChat Pay.
no mobile or other device are required for
payment. This differs from facial recognition
being used in conjunction with a device
(e.g. a smartphone) as a user/transaction
authenticator. See Appendix I for additional
background and insights on facial recognition
payments in China.
Appendix I
Facial recognition technology and
its impact on QR codes in China
Facial recognition technology and its impact on QR code  1 of 3 90

merchant payments in China

Facial recognition payments in China: the next frontier?

User and customer transaction authentication or WeChat Pay. Enrolment is generally the
by facial recognition has been around for most daunting part of the process for many
some time. Facial recognition payments take users and is therefore a potential material
this concept a step further — instead of using barrier to rapid uptake. Experience shows that
a device like a smartphone to authenticate this blocker is significantly mitigated when
oneself, the customer’s face becomes the enrolment is within an app ecosystem that the
payment token that is “scanned” by the customer is already very familiar with, such as
merchant. Authentication and payment Alipay or WeChat Pay.
happen in one step without the need for a
Once enrolled, the customer can go to a store
mobile device.
that has enabled facial recognition payments
Facial recognition payments in China are as a customer payment method and pay for
generally associated with highly sophisticated, items at the checkout via a facial scan by the
unstaffed, cashierless stores. However, the first merchant’s facial recognition camera(s).
step will likely be facial recognition in “traditional”
The most robust systems typically use 3D
stores, which is where Alipay and WeChat Pay
cameras for facial recognition of customers,
are focusing initially with scale in mind.
as these provide the most accurate results.
However, this approach may limit e-commerce
How does it work?
use cases due to the lack of 3D cameras
Customers typically enrol by taking a photo in standard-issue smartphones and other
or series of photos of themselves using a customer devices (although some providers
payment provider’s app, for example, Alipay may build this in to their risk models).
 Facial recognition technology and its impact on QR code  2 of 3 91

merchant payments in China

Facial recognition payments in China: the next frontier?

Primary risks Example implementations

There are a number of risks associated with • In 2019, China introduced regulations that • The 7-Eleven convenience store chain
less-than-robust implementation of this require telecom carriers to scan the faces introduced facial payment technology in May
technology, but the primary risks tend to of users who are registering new mobile 2020 in its stores, mainly in southern parts
relate to: phone numbers. Prior to this, registration of China, including Guangdong Province.
only required a copy of a person’s identity Approximately
• mistaken identity when a facial scan
card. This approach could have far-reaching • 1,000 7-Eleven outlets already use the system,
erroneously identifies the customer; and
consequences. which allows customers to make purchases
• illegal collection and exploitation of facial
• Cities across China have been trialling face by having their faces scanned by point-of-sale
recognition data (e.g. identity theft).
recognition payment systems for their subway tablets with no smartphone required.
networks. Zhengzhou, the capital of northeast
Privacy concerns Henan province, has become the first to roll
Facial recognition technologies have been out the technology on a wide scale. Between
challenged rigorously in many parts of the September and November 2019, nearly
world due to privacy concerns. This is also a 200,000 commuters in Zhengzhou elected
challenge in China, but only a small minority to authorise face-scan payments. While
are attempting to slow the penetration of Zhengzhou is among dozens of Chinese cities
this technology into everyday life, including to introduce such trials, it is the first to deploy
payments. Key privacy concerns relate to the service across its entire subway network.
mass surveillance, government/other tracking • In 2020, Beijing began trialling fast-track
and other monitoring of individuals with no security checks by face scan at one of its
apparent need. subway stations.
 Facial recognition technology and its impact on QR code  3 of 3 92

merchant payments in China

Facial recognition payments in China: the next frontier?

Penetration in China Standardisation

Alipay has installed facial recognition In November 2019, the National

payments capabilities in over 100 cities across Standardisation Group for Facial Recognition
China. Technology was established to study and
develop industry standards. Chinese AI start-
About 118 million Chinese signed up for facial
up SenseTime is leading this initiative with the
recognition payments in 2019 compared to 61
participation of Tencent, China Ping An, Ant
million in 2018 (iiMedia Research, 2020). By
Financial and iFlyTek. Since there is currently
2022, iiMedia Research expects the number
no regulatory involvement, this may increase
of users to exceed 760 million, about half the
the rate at which standards are developed and
country’s population.
implemented ubiquitously.
ATM users at China’s four major banks can
perform transactions by having their faces Conclusion
scanned. Half of China Construction Bank’s
Although facial recognition technology
ATMs are equipped with facial recognition
clearly enables a slick payment process, it has
technology.
some ground to cover before it is ubiquitous
It has been found that new facial payment in China (and it runs up against even more
systems are linked primarily to Alipay and challenges outside China). Once it does gain
WeChat Pay apps. Alipay and WeChat Pay traction, it could lead to the demise of QR
subscribers can use the systems by simply code merchant payments in China.
registering images of their faces.
Appendix J
Emerging QR code merchant payments:
examples from Latin America
— PIX
— Mercado Pago
 Emerging QR code merchant payments in Latin America 94

Latin America is in the early stages of the QR code payments journey: two prominent examples:

“The project will be the embryo of what I believe

is a total transformation in the country’s future
financial intermediation, and will consolidate what
we understand as the new form of payment methods,
with the new fintech industry and with open banking.”
In February 2020, Banco Central do Brasil (the Roberto Campos Neto, President, In February 2020, Banco Central do Brasil (the
central bank) launched the country’s official Banco Central do Brasil Mercado Pago is a digital payment platform
instant payments system brand, PIX. available to consumers and businesses
exclusively in Latin America. It was launched in
With a focus on instant payments, the scheme
Participation is voluntary for entities that have 2003 and originally created as an integrated
enables citizens, companies and government
not yet reached this number of accounts. online payments solution to complement
entities to make instant payments 24x7x365
ecommerce platform MercadoLibre.
through mobile phones, online banking and The government is seeking to demonstrate its
ATMs using QR codes or recipient information, commitment to PIX by ensuring that citizens Mercado Pago processed $19.72 billion worth
such as phone numbers, emails and taxpayer and companies will be able to pay their of transactions between Q1 and Q3 2019, with
identification. federal taxes through PIX from November. the majority of these transactions offline (i.e.
The government also plans to use it to make face to face).
PIX will run within a centralised settlement
payments, such as tax refunds and social
infrastructure, the Instant Payment System,
benefits.
operated and managed by the central bank. Source: MercadoLibre, 2020
All financial institutions with over 500,000 Payment institutions not licensed by the
accounts must adopt the system before mid- central bank will be able to use PIX by settling
November 2020, when the system will be transactions through direct participants,
launched. similar to other schemes.
Appendix K
Scheme specification design and
implementation process
— Proprietary vs harmonised specifications
— Integration approaches to national
harmonisation
 The technical specifications underpinning the design of QR code 96

merchant payment schemes can be proprietary or harmonised

When designing a QR code payments scheme, providers can elect to adopt a proprietary approach
or a more open, harmonised design approach.
The matrix below shows examples of major QR code ecosystem players Examples of major QR code ecosystem players that have chosen to
that have chosen to develop and implement proprietary specifications, develop and implement a more harmonised approach, some using
along with the QR code presentment modalities they support: EMVCo’s EMV specification for QR code merchant payments:

Proprietary specifications approach Harmonised specifications approach

Example schemes MPM CPM
Example schemes MPM CPM
Alipay Supported Supported
EMV QR code specs Supported Supported
WeChat Pay Supported Supported
Hong Kong Common QR Code (HKQR) Not
Supported
MTN Supported Not supported (Hong Kong Interbank Clearing Limited) supported

M-Pesa Supported Not supported SGQR

Supported Supported
(Monetary Authority of Singapore)
Mercado Pago Supported Not supported
JPQR
Kakao Pay Supported Supported Supported Supported
(Payments Japan)

Bharat QR
(National Payments Corporation of India Supported Supported
(NPCI))

Thai QR Payment/MyPromptQR Supported Supported

Quick Response Code Indonesian Standard

Supported Supported
(QRIS)
 Domestic interoperability: example integration approaches to national 97

initiatives with harmonised QR codes

Domestic interoperable schemes – push payments, smartphone-based

a) No changes to National Switch – interoperability at participant level b) Enhance the National Switch – interoperability at Switch level

National initiative where the National initiative where the

ecosystem participants are National Switch(es) makes the
expected to make the changes changes required to enable QR
National payment switches National payment switches
required to enable QR code code payments
payments 0 H armonised static/dynamic QR
0 H armonised static/dynamic QR ‘translation’ layer/dedicated QR scheme switch code presented by merchant
code presented by merchant
1 Customer scans QR code
1 Customer scans QR code 3 4 3 4 2  ustomer authenticates for
C
2  ustomer authenticates for
C transaction
transaction ‘translation’ layer ‘translation’ layer ‘translation’ layer ‘translation’ layer
3  ustomer’s account provider
C
3  ustomer’s account provider
C pushes payment to merchant’s
Customer’s Customer’s
converts QR code payment
account/ ‘Optional’ National Merchant account/ ‘Optional’ National Merchant acquirer/bank via the national
to native switch payment and Merchant Registry acquirer Merchant Registry acquirer switch (switch translates QR
pushes payment to merchant’s app provider app provider payment or ahs dedicated QR
acquirer/bank via the national scheme)
switch)
4  erchant acquirer receives QR
M
2 5 2 5
4  erchant acquirer receives
M payment from switch
native switch payment and
5  erchant receives payment
M
‘translates’ into QR payment
confirmation; hands goods to
5  erchant receives payment
M Harmonised Harmonised the customer
confirmation; hands goods to
Customer 1
QR code (MPM)
0 Merchant Customer 1
QR code (MPM)
0 Merchant
the customer
Appendix L
Optimising implementation of QR code
merchant payments
— Customer experience
— Merchant device affordability
— Feature phone compatibility
 Optimising for: Customer experience 99

Schemes around the world have adopted different approaches to the customer experience.
Typically, CPM appears to provide the optimal experience for medium and larger merchants
while static MPM dominates the micro-merchant ecosystem.

Scheme Customer
Mode Payment flow (pre-transaction ~ transaction complete)
example impact

Bharat
MPM High
QR
1 Enter your 2 The customer 3 Enter the amount to 4 Select the payment 5 Receive a 6 Receiving a digital
username and scans the QR code be paid account confirmation receipt
password to log in displayed message after
and click on Pay in payment
Bharat QR option

WeChat
CPM Low
Pay 1 Log in to WeChat, successful 2 The merchant scans the QR 3 If the payment system 4 Display of a payment message
launch Quick Pay code displayed by the customer determines that it is necessary if the payment settlement has
and sends the order infromation to enter a password, the been completed correctly.
to the payment system on the password entry screen will be
WeChat payment server displayed and the user will enter
the password
 Optimising for: Merchant device affordability 100

Merchants will select their ideal POS solution and device typically based on their size, maturity
and budget constraints. Static QR code stickers at the merchant’s check-out location are the
most common for micro-merchants.

Required merchant devices Cost MPM / CPM Static / Dynamic QR code Suitable circumstance

PAYMENT
• Small businesses in developing countries
QR Low • Areas with inadequate internet access
MPM Static
stickers ~$0 • Retailers, stalls, etc. that do not allocate a budget to implement portable and
POS systems, but want to implement them inexpensively

• Small and medium enterprises (SMEs) in developed countries

• Those seeking to introduce QR code merchant payments as soon as possible
Potrtable without replacing their existing POS system
Mid
POS MPM/CPM Dynamic
$300 • Mid-sized retail and food service outlets, etc.
terminal

*These require an internet connection for QR code merchant payments.

• Large chain stores, such as supermarkets, convenience stores and drug stores
• The POS system is often bespoke and an internet connection is required for
POS High
CPM Dynamic the system to operate
system $1,000+
• Large stores and chain stores that can allocate a large budget to implement
such systems
 Optimising for: Feature phone compatibility 101

QR code payment transaction type: In this scenario, the customer uses a feature phone that cannot scan QR codes and is therefore required to Applies to:
manually key the number printed adjacent to the merchant’s QR code sticker (e.g. Merchant ID) to initiate a
• Merchant Presented (MPM)
USSD dialogue to complete the transaction.
• Static or Dynamic QR code*
This is not strictly a QR code payment transaction as the QR code is not scanned. This type of transaction
Feature phones are • USSD payment exists solely to enable feature phone payments within QR code payments schemes, i.e. backwards
Feature
compatibility in feature phone dominated markets.
typically unable to phone**

OFFLINE – NO DATA CONNECTIVITY REQUIRED. PAYMENT THROUGH USSD CHANNEL

scan or display QR
1 2 3 4 5
codes. This means
that some QR code
scheme providers
have elected to
include some form Merchant rings up goods Customer opens payment app, USSD gateway asks customer USSD gateway asks for mobile Merchant receives payment
of human readable and enters transaction details. USSD gateway asks for merchant
ID number which customer enters.
for transaction amount to be
entered.
money banking PIN to be
entered to authorise transaction.
confirmation. Customer takes
goods, merchant waits to
identifier alongside receive settlement of funds.

the merchant’s Example QR

code sticker:
QR code sticker/
screen. This enables
customers with
feature phones 982309
USSD Provider USSD USSD Provider USSD USSD Provider API Merchant
to complete the gateway system gateway gateway system gateway gateway system system

transaction using
manual key entry
within the USSD
channel instead of
scanning the QR
code.**

* A notification may be sent to the customer confirming various details, such as merchant name and amount, which the customer can either confirm or reject.
** Note: the exception would be a feature phone that has the screen graphics capability to display a QR code image and sufficient resolution for it to be reliably and
successfully scanned by the merchant.
Appendix M
Security and risk management
— Approaches to mitigating primary
security risks
 Security and risk management: primary threats 103

As with all payments ecosystems, there are Customer Merchant

a number of risks inherent in the QR code 2 4
merchant payments ecosystem. QR code Fake QR code Falsification
merchant payment providers will need to
address the following key security risks:

Merchant system

1
Customer Merchant
Lost or stolen application application

1 3
API
Lost or stolen Hacking/cracking

Provider system

* This diagram is based on an offline (in-store) payment and merchant-presented

mode (MPM). Product flow can differ depending on the QR payment scheme.
 Security and risk management: primary threats 104

Examples of appropriate risk mitigation responses:

Risk Appropriate risk mitigation response

Name Detail Approach Detail
  Lost
1 or stolen Unauthorized use can occur if a smartphone Reduction Add biometric authentication, such as facial recognition, fingerprint
with a QR code payment app and the password scanners and voice identification. A two-step verification system can
were stolen. also reduce the risk.
QR code shoulder hacking Reduction To pay with a QR code, the app must have limits, such as a time limit on
the validity of a QR code or trial.
If there is no time limit to use a QR code, QR
code shoulder hacking may occur.
  Fake
2 QR code QR code phishing Avoidance The QR code payment app should not redirect the user to a website
via the phone’s browser, which would increase the number of victims
Attacker replaces original QR code and the fake of QR code phishing, or the QR code payment application should scan
QR code leads the user to malicious internet the vulnerability of redirected. It is preferable that merchants not use
content. paper-printed QR codes because these are easy to replace.
  Hacking/cracking
3 The information on the QR code payment Reduction A QR code cannot be hacked (apart from fake QR codes), but the QR
system contains personal financial information code payment system could contain vulnerabilities. Therefore, there
that is targeted by the hacker. should be unified security guidelines that all QR code payment system
providers must follow. They should also be audited.

Example:
Japan began unifying QR code merchant payments in 2019, when
the Ministry of Economy issued Guidelines for Unified Standard
Code-Payment Technologies: CPM (Consumer-Presented Mode) and
Guidelines for Unified Standard Code-Payment Technologies: MPM
(Merchant-Presented Mode).
  Falsification
4 Cashier may conduct fraud if the payer’s QR Avoidance Time-limited QR codes should be generated every time customers
codes are not generated every time they use it. present their QR codes to cashiers.
105