QR Code Payments

What Are QR Code Payments?

QR code payments are financial transactions initiated by scanning a Quick Response (QR) code with a smartphone camera or payment app. The QR code encodes payment details: a merchant identifier, account number, transaction amount, or payment request URL. Once scanned, the payer's app decodes the data, displays the transaction for confirmation, and submits it through the underlying payment processor or bank network.

Unlike card-based payments that require physical terminals, card readers, and network connectivity through acquirer infrastructure, QR code payments need only a printed image and a smartphone. This makes them dramatically cheaper to deploy: a street vendor in Mumbai or São Paulo can accept digital payments with nothing more than a laminated printout. The global QR code payment market processed over $3 trillion in transactions in 2025, with the market for QR payment infrastructure projected to reach $38 billion by 2030.

QR code payments emerged in China around 2013 through Alipay and WeChat Pay, then spread rapidly across Asia. India's Unified Payments Interface (UPI) and Brazil's PIX system adopted QR codes as their primary point-of-sale interface, transforming both countries into largely cashless economies for everyday transactions.

How It Works

The EMVCo QR Code Specification for Payment Systems (EMV QRCPS), published in 2017, defines two standardized presentment modes that cover nearly all QR payment implementations worldwide.

Merchant-Presented Mode (MPM)

In merchant-presented mode, the seller displays a QR code and the customer scans it. This is the dominant model in emerging markets because of its simplicity and zero hardware cost for the merchant. MPM comes in two variants:

• Static QR codes are printed once and reused indefinitely. They encode the merchant's account identifier but not the transaction amount: the customer enters the amount manually in their app. This works well for small merchants (street stalls, taxi drivers, market vendors) because the cost is literally a sheet of paper.
• Dynamic QR codes are generated per transaction by the merchant's POS system or app. They embed the exact amount, a unique transaction reference, and sometimes an expiration time. This simplifies reconciliation and enables automated receipts. Most large retailers and e-commerce checkout flows use dynamic codes.

Customer-Presented Mode (CPM)

In customer-presented mode, the buyer generates a QR code on their phone and the merchant scans it using an optical reader or POS terminal. This model is common in markets with existing POS infrastructure (Japan, South Korea, parts of Europe) and in transit systems where speed matters: the customer holds their phone to a scanner and the gate opens.

CPM codes are always dynamic: the customer's app generates a fresh, time-limited code for each transaction. The merchant's scanner reads the code, extracts the customer's payment token, and initiates a charge through the payment network.

Technical Transaction Flow

A typical merchant-presented QR code payment follows these steps:

1. The merchant's system generates a QR code containing structured payment data: a payload format indicator, merchant account information, transaction amount, currency code, country code, and a CRC checksum for integrity verification
2. The customer opens their payment app and scans the QR code with their phone camera
3. The app decodes the QR payload, extracts the payment parameters, and displays the transaction details for the customer to review
4. The customer authenticates using a PIN, biometric (fingerprint or face), or device passcode
5. The app submits the authorized transaction to the payment network (UPI, PIX, Alipay, or a bank's API gateway)
6. The network validates the transaction, checks the payer's balance or credit, and routes the payment to the merchant's account
7. Both parties receive confirmation: typically within 2 to 5 seconds for real-time payment systems

EMVCo Data Format

The EMV QRCPS merchant-presented specification uses a Tag-Length-Value (TLV) encoding. Each data element has a two-digit ID, a two-digit length, and a variable-length value. A simplified example of the encoded payload:

00 02 01          # Payload Format Indicator: "01"
01 02 12          # Point of Initiation: "12" (dynamic)
26 36             # Merchant Account Information (template)
  00 16 com.example.pay   # Payment network identifier
  01 13 1234567890123      # Merchant account number
52 04 5812        # Merchant Category Code
53 03 356         # Transaction Currency (JPY)
54 04 1500        # Transaction Amount
58 02 JP          # Country Code
59 09 STORENAME   # Merchant Name
63 04 A1B2        # CRC checksum

This structured format allows any compliant app to parse the QR code regardless of the underlying payment network, enabling interoperability across different providers and countries.

Global Adoption

China: Alipay and WeChat Pay

China pioneered mass-market QR code payments starting around 2013. Alipay (owned by Ant Group) holds approximately 54% of the mobile payments market, while WeChat Pay (Tencent) commands about 42%. Together they process over $5.5 trillion in annual transactions. QR codes are ubiquitous in Chinese commerce: from high-end restaurants to street food vendors, taxi drivers, and even beggars. The infrastructure requires no card network involvement: payments move directly between app wallets or linked bank accounts.

India: UPI

India's UPI system has driven explosive QR code adoption since its launch in 2016. By mid-2025, over 709 million active UPI QR codes were deployed across the country. UPI processed 172 billion QR-based transactions in fiscal year 2024-2025, with total transaction value exceeding $2.4 trillion. UPI QR codes are account-to-account: they bypass card networks entirely, moving funds directly between bank accounts through India's National Payments Corporation (NPCI) infrastructure.

Brazil: PIX

Brazil's PIX instant payment system, launched by the Central Bank of Brazil in November 2020, uses QR codes as its primary point-of-sale interface. PIX has reached 175 million users (160 million individuals and 15 million businesses) and processed 42 billion transactions in 2024, making Brazil the third-largest QR payment market globally. PIX supports both static QR codes for small merchants and dynamic codes for larger transactions with automatic reconciliation.

Other Markets

Japan recorded 9.36 billion QR code transactions in 2023, with monthly active users growing from 23 million in 2020 to over 82 million by late 2024. In Europe, the European Payments Initiative (EPI) launched Wero in 2024, a QR-based payment system backed by 16 major European banks, reaching 40 million enrolled users in its first year. Southeast Asian countries including Thailand (PromptPay), Singapore (PayNow), and Indonesia (QRIS) have all built national QR payment standards.

Cost Advantage Over Card Terminals

QR code payments offer significant cost savings for merchants compared to traditional card acceptance:

UPI charges merchants zero transaction fees on QR payments. PIX charges are capped well below card interchange fees. Even in markets where QR payment providers charge fees, they typically run 1% or less compared to the 2-3% that card networks charge through merchant discount rates. This cost difference is why QR codes dominate in price-sensitive markets where card infrastructure was never widely deployed.

QR Codes in Bitcoin and Lightning

Bitcoin's Lightning Network relies heavily on QR codes as the primary user interface for payments. When a recipient creates a Lightning invoice, the invoice string (encoded in the BOLT 11 format) is typically displayed as a QR code for the sender to scan.

BOLT 11 Invoices

A BOLT 11 invoice encodes the payment hash, amount, expiration time, destination node ID, and routing hints into a bech32-encoded string. This string is often long (hundreds of characters), making QR codes the practical way to transmit it between devices. A typical BOLT 11 QR code contains:

lnbc1500n1pj...  # Prefix: ln (Lightning) + bc (mainnet)
                       # Amount: 1500 satoshis
                       # Payment hash (32 bytes)
                       # Expiry: 3600 seconds (default)
                       # Destination node public key
                       # Route hints (if needed)
                       # Signature

BOLT 11 invoices are single-use: each invoice contains a unique payment hash and expires after a set time. This means merchants cannot use a static printed QR code for Lightning payments using BOLT 11 alone.

BOLT 12 Offers

BOLT 12 addresses this limitation by introducing reusable payment offers. A BOLT 12 offer is a compact, static string that can be printed as a permanent QR code. When scanned, the sender's wallet contacts the recipient's node through onion routing to request a fresh invoice, which is then paid normally. This makes BOLT 12 function similarly to a merchant-presented static QR code: print once, receive payments indefinitely. BOLT 12 also incorporates blinded paths for receiver privacy.

Unified QR Codes

Bitcoin wallet developers have worked on unified QR code formats that combine an on-chain Bitcoin address with a Lightning invoice or offer in a single code. This allows the sender's wallet to choose the best payment method automatically. A unified QR might encode both a bitcoin: URI for on-chain fallback and an embedded Lightning invoice for instant settlement, giving merchants a single code that works for all Bitcoin payment types.

Use Cases

In-Store Point of Sale

The most common use case is face-to-face retail. A merchant displays a QR code (printed or on screen) and the customer scans to pay. This works for everything from convenience stores in Tokyo to tea shops in Bangalore. For merchants processing small transactions, the elimination of card terminal costs makes digital payments viable for the first time.

E-Commerce and Online Checkout

Online merchants display a QR code during checkout. The customer scans with their phone's payment app, authenticates, and the payment completes. This is particularly common in markets where card penetration is low but smartphone ownership is high: rather than entering card details on a web form, the customer scans and pays from their mobile wallet.

Peer-to-Peer Transfers

Users can generate personal QR codes linked to their payment accounts. Splitting a restaurant bill, paying a friend, or collecting money for an event can all happen by sharing a QR code. UPI and PIX both support this natively, making person-to-person transfers as simple as scanning a code.

Cross-Border Payments

Several countries are linking their QR payment systems for cross-border transactions. Singapore's PayNow and Thailand's PromptPay are interconnected, allowing tourists to scan local QR codes and pay from their home wallet. India's UPI has signed interoperability agreements with payment systems in Singapore, the UAE, Sri Lanka, and several other countries. These linkages bypass traditional correspondent banking rails and their associated fees.

Bitcoin Lightning Payments

Lightning-enabled merchants use QR codes to present invoices to customers. The customer scans the QR code with their Lightning wallet, confirms the amount, and the payment settles in seconds over the Lightning Network. This is particularly relevant for Bitcoin merchant payment adoption, where QR codes provide a familiar payment interface for customers already accustomed to scanning codes in their daily lives.

Risks and Considerations

QR Code Tampering (Quishing)

The most significant security risk is QR code replacement fraud, known as "quishing." Attackers place a fraudulent QR code sticker over a legitimate merchant's code, redirecting payments to the attacker's account. This attack is effective because QR codes are opaque to the human eye: users cannot visually distinguish a legitimate code from a malicious one. Quishing attacks rose 587% between 2023 and 2025 according to UK's Action Fraud, and Europol flagged it as the fastest-rising payment initiation attack in the EU in 2026.

Dynamic QR codes mitigate this risk because they change with every transaction, making sticker overlays ineffective. Static codes remain vulnerable. Merchants should regularly inspect their displayed codes for tampering.

Lack of Chargeback Protection

Most QR code payment systems operate on push payment rails: the customer initiates and authorizes the transfer. Unlike card payments, there is typically no chargeback mechanism. Once the customer confirms the payment, the funds move and cannot easily be reversed. This is an advantage for merchants (no chargeback fraud) but a risk for consumers who pay a fraudulent QR code.

Interoperability Fragmentation

Despite EMVCo's standardization efforts, QR payment systems remain largely siloed by country and provider. An Alipay QR code cannot be scanned by a UPI app, and a PIX code does not work in a WeChat Pay wallet. Cross-border interoperability agreements are growing but remain bilateral and limited in scope. Travelers often need to download local payment apps or rely on international partnerships between specific providers.

Privacy Considerations

QR code payments through centralized systems (Alipay, WeChat Pay, UPI) create detailed transaction records tied to real identities. Every purchase, its amount, location, and timestamp are logged. Bitcoin Lightning QR codes offer more privacy: BOLT 12 offers incorporate blinded paths that prevent the sender from learning the recipient's node identity, and Lightning payments use onion routing to obscure the payment path from intermediate nodes.

Why It Matters

QR code payments have proven that digital payments do not require expensive infrastructure. The card network model, built on terminals, acquirers, issuers, and scheme fees, costs merchants 2-3% per transaction and excludes billions of small businesses that cannot afford the hardware. QR codes collapsed this cost to nearly zero in countries like India and Brazil, bringing hundreds of millions of people into the digital payments ecosystem for the first time.

For Bitcoin and the Lightning Network, QR codes serve the same role: making payments accessible without specialized hardware. As real-time payment systems continue expanding globally, QR codes remain the dominant physical-world interface. Platforms like Spark that enable fast, low-cost Bitcoin transfers benefit from this ecosystem: users already comfortable scanning QR codes for payments face no learning curve when scanning a Lightning invoice or BOLT 12 offer.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.