How QR Code Payments Work
QR code payments convert a payment instruction into a scannable image that any smartphone camera can decode. The flow takes seconds and requires no physical card swipe, chip insertion, or NFC tap — just a camera and a compatible payment app.
Code Generation
The merchant's POS system or payment app generates a QR code encoding the payment details: amount, currency, merchant ID, and a unique transaction reference. For static codes, the merchant displays a pre-printed image; for dynamic codes, a fresh code is generated per transaction with an expiry timer.
Customer Scan
The customer opens their mobile wallet app — or uses their phone's native camera — and points it at the QR code. The app decodes the payment URL or structured payment data embedded in the code and surfaces the transaction details for review.
Authentication
The payment app presents the transaction amount and merchant name for customer confirmation. The customer authenticates using biometrics (Face ID, fingerprint), a PIN, or the app's own security method before authorizing the payment.
Authorization Request
The payment app sends an authorization request to the payment network — such as Alipay, WeChat Pay, UPI, or a card scheme — over an encrypted connection. This request routes to the customer's bank or wallet provider for funds verification.
Settlement Confirmation
The payment network responds with an approval or decline in real time. Both the merchant's terminal and the customer's app display a confirmation state. Settlement follows the network's schedule — typically T+0 or T+1 for domestic QR rails.
Why QR Code Payments Matter
QR code payments have moved well beyond a niche workaround — they are a primary payment rail in several of the world's largest economies and are accelerating globally. Their hardware-light infrastructure makes them disproportionately valuable for merchants in emerging markets and for any business serving mobile-first consumers.
According to Mordor Intelligence, the global QR code payment market was valued at approximately $11.2 billion in 2023 and is projected to surpass $35 billion by 2028, reflecting a compound annual growth rate above 25%. In China, Alipay and WeChat Pay together process over $50 trillion in annual payment volume, with QR codes as the dominant acceptance mechanism at the point of sale. A 2023 PYMNTS study found that nearly 60% of US consumers had scanned a QR code to make a payment in the previous 12 months, up from under 30% pre-pandemic — confirming that adoption is no longer confined to Asian markets.
Why hardware cost matters
A static QR code display costs nothing beyond printing. A dynamic code requires only a tablet or small screen. Compare this to an NFC-capable POS terminal at $200–$800 or more — QR payments unlock acceptance for micro-merchants, market stalls, and pop-up vendors who cannot justify terminal investment.
QR Code Payments vs. NFC Payments
Both QR codes and NFC enable contactless payment without a physical card swipe, but they differ substantially in hardware requirements, merchant cost, speed, and geographic reach. Understanding the tradeoffs helps merchants choose the right acceptance method per market.
| Factor | QR Code Payments | NFC / Tap-to-Pay |
|---|---|---|
| Customer hardware | Smartphone with camera | NFC-enabled card or phone |
| Merchant hardware | Printed or screen display | NFC-enabled terminal ($200–$800+) |
| Transaction speed | 3–8 seconds | 1–2 seconds |
| Offline capability | Limited (most require connectivity) | No (terminal must be online) |
| Fraud surface | QR substitution, phishing URLs | Card skimming, relay attacks |
| Geographic strength | Asia-Pacific, India, Latin America | EU, US, Australia, UK |
| Card network dependency | Often bypasses card networks entirely | Typically routed via Visa/Mastercard |
| Merchant fee range | 0.1%–0.6% (many Asian QR networks) | 1.5%–3%+ (card interchange) |
For merchants in markets where NFC terminal penetration is low, QR codes offer a faster and cheaper path to accepting mobile wallet payments from a broad customer base.
Types of QR Code Payments
QR code payment implementations fall into several distinct categories based on who presents the code and how transaction data is encoded. Choosing the wrong type for a given use case introduces unnecessary friction, security risk, or reconciliation complexity.
Static QR Codes encode fixed merchant information — a wallet address or payment URL. The payer enters the amount manually. Common for tips, donations, and very small merchants. The simplicity comes with higher fraud risk because a substituted sticker can redirect all payments to an attacker.
Dynamic QR Codes are generated per transaction and encode the exact amount, currency, merchant reference, and an expiry timestamp. They become invalid after a single payment or after the timer lapses. Preferred for any retail or ecommerce context where automated reconciliation matters.
Consumer-Presented Mode (CPM) means the customer opens their app and shows a QR code that the merchant's barcode scanner reads. Used widely by Alipay and WeChat Pay in physical retail. The merchant controls scan speed, which typically makes CPM faster at the checkout lane than MPM.
Merchant-Presented Mode (MPM) means the merchant displays the QR code and the customer scans it. Requires only a printed or on-screen display on the merchant side, making it the lowest-cost model for small businesses accepting alternative payment methods.
Interoperable / National QR Standards — regulators in several countries have unified QR code formats so a single merchant code works across multiple competing wallet apps. Examples include India's BharatQR, Thailand's PromptPay, Singapore's SGQR, and the EMVCo QR standard. These reduce fragmentation for merchants who do not want to manage separate codes per provider.
Best Practices
Getting QR code payments right involves more than printing a code and considering the job done. Implementation quality directly affects conversion rates, security posture, and reconciliation accuracy.
For Merchants
- Use dynamic QR codes for all fixed-price transactions. Static codes require customers to enter the amount manually, introducing error and friction, and preventing automated reconciliation against your order management system.
- Secure physical displays against substitution. Place QR code displays in recessed frames, behind glass, or on tamper-evident laminated surfaces. Inspect them regularly. QR substitution fraud — a fraudulent sticker placed over your legitimate code — is the most common in-store attack vector.
- Show a confirmation on both the customer and merchant screen. After payment approval, display a clear success state on your side before releasing goods. Train staff to check this rather than relying solely on verbal confirmation from the customer.
- Test across the wallet apps your customers actually use. Code rendering and URL handling can vary between Alipay, WeChat Pay, Google Pay, Apple Pay, and regional wallets. Run acceptance tests before going live in each market.
- Monitor scan-to-payment conversion separately. Track how often a customer scans your code but does not complete payment. High abandonment between scan and confirm often signals UX friction in the wallet app flow or a mismatched code format.
For Developers
- Enforce QR code expiry server-side, not just at the display layer. Dynamic codes should have a TTL — typically 60–300 seconds — and the backend must reject payment attempts referencing expired codes regardless of what the front end shows.
- Handle webhook idempotency explicitly. Payment callbacks from QR networks can arrive more than once due to retries. Your handler must deduplicate using the transaction reference to prevent double-fulfillment of orders.
- Validate HTTPS and certificate chain on all payment URLs. Any QR code that encodes a URL must link to a valid HTTPS endpoint. Payment apps should surface a warning — and ideally refuse — if the destination fails TLS validation.
- Log scan events and payment events as separate telemetry. This lets you diagnose the gap between "customer scanned" and "payment completed," which is critical for debugging network timeouts, authentication failures, and expiry issues.
- Implement the national interoperable standard for each target market. Proprietary formats lock out customers using wallets that only accept the regional standard. Start with EMVCo QRCPS or the local equivalent, then layer provider-specific extensions.
Common Mistakes
Even experienced payment teams make predictable errors when deploying QR code payments. Knowing them before launch saves significant debugging time and customer-facing failures.
1. Using static codes for all transactions. Defaulting to static QR codes because they are easy to print is the most widespread mistake. For any transaction with a defined price, this forces manual amount entry, breaks automated reconciliation, and increases the risk of overpayment or underpayment errors. Always generate dynamic codes at the point of sale for fixed-price goods and services.
2. Ignoring physical QR substitution risk. Placing a printed QR code on an exposed counter without protective measures invites fraud. An attacker can overlay a sticker in seconds, redirecting all subsequent payments to their own wallet. Physical security — tamper-evident holders, regular staff inspection, integrated display screens — is as important as any software control.
3. Failing to handle code expiry gracefully. Dynamic codes expire. If authentication takes longer than the TTL, the payment attempt will fail at the backend even though the customer believes they have paid. Systems that do not surface a clear "code expired — please scan again" message leave customers confused and support queues full.
4. Skipping reconciliation testing under async conditions. QR payment networks frequently use asynchronous settlement where the callback arrives seconds or even minutes after the initial authorization. Teams that test only the synchronous happy path miss duplicate-callback, delayed-callback, and timeout scenarios that cause real financial discrepancies in production.
5. Assuming one QR format is universally accepted. A code valid for WeChat Pay MPM will not necessarily be accepted by UPI, PromptPay, or GrabPay. Each network encodes data differently. Merchants targeting multiple markets must generate network-specific codes or implement a recognized interoperable standard — not assume their single existing code will work everywhere.
QR Code Payments and Tagada
Tagada is a payment orchestration platform that routes transactions across multiple acquirers and payment methods from a single API integration. QR code payments fit directly into that model — particularly for merchants operating across Asia-Pacific, India, and Latin American markets where QR rails carry significantly lower fees than card interchange and where a single regional wallet can represent the majority of in-store volume.
If your checkout needs to accept Alipay, WeChat Pay, UPI, PromptPay, or any regional QR wallet alongside cards and bank transfers, Tagada routes all of them through one integration — with unified reporting, cross-method reconciliation, and automatic fallback logic if a QR network is temporarily unavailable.
When building a multi-market checkout, Tagada's orchestration layer normalizes the callback payload formats from different QR networks, so your backend processes a consistent event schema rather than maintaining separate webhook handlers per provider. For merchants expanding into new markets, this dramatically reduces the time from contract signature to live acceptance of a new payment gateway or regional QR scheme.