Payment QR Code
A payment QR code is a QR code that carries the details of who should be paid, and sometimes how much, so a payment app can start a transfer after one scan. The payer confirms the payment inside their own banking or wallet app. It replaces typing an account number, card number, or payment link by hand.
How a Payment QR Code Works
A payment QR code holds text, not money. The text names the payee and, optionally, an amount, currency, and reference. The scanning app reads it, shows the payee name, and asks the payer to approve.
Two scan directions exist. In merchant-presented mode, the shop displays the code and the customer scans it. In consumer-presented mode, the customer’s app displays a code and the merchant’s scanner reads it. EMVCo, the body behind chip-card standards, publishes specifications for both.
The money moves over the payment network behind the app, such as a bank transfer system or card network. The QR code only carries the instructions.
Payment QR Code Formats
Most payment QR codes follow one of two patterns: a URI link or an EMV-style data string.
UPI QR codes are used in India. They encode a upi://pay link built from NPCI’s deep-linking specification. The main fields are pa (payee UPI ID), pn (payee name), am (amount), cu (currency, INR), tn (note), and tr (transaction reference).
upi://pay?pa=brewcafe@examplebank&pn=Brew%20Cafe&am=250.00&cu=INR&tn=Order%2042&tr=INV0042
EMV merchant QR codes are used in many countries. They encode a string of tag-length-value fields. Tag 00 is the format version, tag 01 marks the code as static (11) or dynamic (12), tag 54 holds the amount, and tag 63 holds a checksum. Brazil’s Pix BR Code is built on this format. Other national schemes layer their own account fields on top of it.
Static vs Dynamic Payment QR Codes
A static payment QR code carries fixed payee details and no amount, so the payer types the amount. A dynamic payment QR code is generated for one order and carries the amount and a reference. This split describes the payload. It differs from the marketing split between a static QR code and a dynamic QR code, where “dynamic” means an editable redirect link.
| Type | Amount | Reuse | Typical use |
|---|---|---|---|
| Static | Payer enters it | Many payments | Counter sticker, donation box |
| Dynamic | Fixed in the code | One payment, often with an expiry | Checkout screen, invoice, bill |
Pix developer documentation describes the same split: static codes can be paid repeatedly and do not expire, while dynamic codes are paid once and carry an identifier for reconciliation.
What the Code Contains: A Size Test
A reproducible test built each payload with Segno 1.6.6 and decoded it with zxing-cpp 3.1.1, using fictional merchant data. Every code decoded back to the exact payload.
| Payload | Characters | QR version (level M) | Module size at 2.5 cm |
|---|---|---|---|
| UPI, payee and name only | 55 | 4 | 0.76 mm |
| UPI with amount, note, reference | 90 | 6 | 0.61 mm |
| EMV static, no amount | 100 | 6 | 0.61 mm |
| EMV dynamic, amount 25.00 | 109 | 7 | 0.56 mm |
Adding an amount and reference pushes a code up in density, which shrinks each module at a fixed print size. For a counter sticker, print larger than the minimum.
Checksums Catch Errors, Not Fraud
EMV payment codes end with a CRC-16 checksum (tag 63). The test changed one digit of the amount in a dynamic payload, from 25.00 to 25.90. The code still scanned, but the checksum no longer matched, so a compliant app would reject it.
That protects against printing and transmission errors. It does not stop a fraudster, who can recompute the checksum for any payload. A payment QR code proves nothing about who made it.
Payment QR Code Safety
The main risk is a swapped code. A criminal places a sticker with their own payee details over a genuine code. The payment then goes to the wrong account.
- Check the payee name the app displays before approving.
- Be wary of any code that looks stuck on over another one.
- Treat a payment code received in a message or email like any unknown link.
- For dynamic codes, confirm the amount shown matches the bill.
Businesses can reduce risk by displaying codes on screens or behind the counter. A QR code that leads to a fake payment page instead of a real one is a form of quishing (QR code phishing).
Frequently Asked Questions
What is a payment QR code?
A payment QR code stores the payee and, optionally, the amount, so a payment app can pay in one scan. The code holds text only. The actual transfer happens in the payer’s banking or wallet app.
What is a UPI QR code?
A UPI QR code is a payment QR code that encodes a upi://pay link with the payee’s UPI ID, name, and optional amount. Any UPI app can scan it. The payer sees the payee name and confirms with a PIN.
Is a QR code payment safe?
Scanning is safe when the code is genuine and the payee name matches. The main risk is a fake sticker placed over a real code. Always read the name the app shows before approving a payment.
Can a payment QR code be tracked?
A code that pays the merchant directly cannot be tracked by the marketer, because the scan goes to the payment app. To measure which counter, table, or invoice drives payments, point each code at a tagged short link that opens the payment page.
Teams that want per-placement results can set up cashless QR payment tracking with one tagged code per point of sale.