QR Code Payment Systems: How QR Pay Works in 2025

The Global Rise of QR Payments

QR code payments have gone from a niche experiment to a dominant payment method for billions of people worldwide. In China, more than 80% of mobile payments are processed via QR codes through WeChat Pay and Alipay. India's Unified Payments Interface (UPI) processes over 10 billion QR-linked transactions every month. From street food vendors in Bangkok to luxury retailers in New York, the humble QR code has become the connective tissue of the global cashless economy.

The appeal is straightforward: no card terminal, no NFC hardware, no contactless chip required. Any merchant with a printed QR code and a smartphone can accept digital payments instantly. This low barrier to entry has made QR payments especially transformative in emerging markets, where card infrastructure remains limited but smartphone penetration is surging.

How QR Code Payments Work

QR payment systems operate in two distinct modes, each suited to different checkout scenarios:

• Merchant-Presented QR (MPM): The merchant displays a static or dynamic QR code — printed at the counter or shown on a screen. The customer opens their payment app, scans the code, confirms the amount, and authorises the transfer. This is the most common model for retail and restaurants.
• Customer-Presented QR (CPM): The customer opens their payment app to generate a one-time QR code tied to their account and payment credentials. The merchant's scanner reads it. This model is used by apps like PayPal, Alipay, and Starbucks, providing tighter fraud controls because the code expires within seconds.

In both cases, the QR code encodes a payment URI or token — not raw account numbers. The actual funds transfer happens over a secure backend network between financial institutions, often using standards like ISO 20022 or EMVCo's QR code specification for interoperability.

Major QR Payment Platforms Around the World

QR payment adoption varies by region, driven by local fintech ecosystems and regulatory frameworks:

• WeChat Pay & Alipay (China): The originals. Both support MPM and CPM, operate cross-border, and have inspired every major QR payment system that followed.
• UPI / BHIM (India): A government-backed interoperable rail that lets any bank's app generate or scan QR codes to move money instantly between accounts.
• Paytm (India): The country's largest third-party QR network, with over 30 million merchant QR codes deployed at small businesses nationwide.
• PayPal & Venmo (USA): Both support QR-based in-person payments, allowing users to send or receive money without card readers.
• PromptPay (Thailand), DuitNow (Malaysia), PayNow (Singapore): Government-backed regional systems built on QR infrastructure for real-time interbank transfers.
• PIX (Brazil): The Central Bank of Brazil's instant payment system, which uses QR codes as its primary point-of-sale interface.

Security Architecture of QR Payments

Security is layered across the entire QR payment chain. The QR code itself contains a tokenised payment address — not a bank account or card number — so intercepting the visual code yields no reusable financial data. Dynamic QR codes add time-based expiry, invalidating a code after 60–90 seconds. Most platforms also implement:

• End-to-end encryption between the customer's app and the payment gateway
• Biometric or PIN authentication before transaction authorisation
• Transaction amount confirmation screens to prevent manipulation
• Real-time fraud scoring and anomaly detection on backend networks
• EMVCo QR Code Specification compliance for cross-terminal interoperability

Advantages Over Traditional Card Payments

QR payments offer concrete advantages over magnetic stripe and chip-and-PIN card systems:

• Zero hardware cost for merchants: A printed A4 sheet is a fully functional payment terminal.
• Instant settlement: Many QR systems settle in real time, compared to T+1 or T+2 for card networks.
• Lower transaction fees: Many QR payment rails charge 0–0.5% per transaction versus 1.5–3% for card networks.
• Hygienic and contactless: Customers never touch a shared device, eliminating physical contact entirely.
• Financial inclusion: Unbanked users can access QR payments via e-wallets without a traditional bank account.

Limitations and Risks

Despite their strengths, QR payments carry genuine risks that users and merchants should understand:

• QR substitution fraud: Attackers place fake QR stickers over legitimate merchant codes, redirecting payments to fraudulent accounts.
• Phishing via QR: Malicious QR codes in public spaces can redirect users to credential-harvesting websites.
• No chargeback protection: Unlike credit cards, most QR payment transfers are irrevocable once authorised.
• Smartphone dependency: Customers without a charged smartphone or data connection cannot pay.
• Fragmentation: Merchant QR codes may only work with specific apps — interoperability is still uneven across markets.

Are QR Payments the Future?

The trajectory is unmistakably upward. The EMVCo global QR standard is slowly harmonising cross-border payment acceptance, meaning a tourist from Brazil could one day scan a QR code in Japan using their home app without friction. Central bank digital currencies (CBDCs) being piloted in dozens of countries are also being designed with QR payment interfaces as their primary consumer touchpoint. By 2027, analysts project that QR-based payment volume will exceed $3 trillion annually worldwide — a figure that would have seemed implausible just a decade ago.

Conclusion

QR code payment systems represent one of the most consequential applications of a technology originally designed for factory floors. Their simplicity, low cost, and accessibility have made them the de facto payment method for a large portion of humanity — and their reach is only growing. Whether you're a business owner looking to accept payments without a card terminal, or a traveller navigating a cashless city abroad, understanding how QR payments work equips you to participate confidently in the modern financial landscape.