QR codes are increasingly being adopted by merchants

Recently, QR codes—or Quick Response codes—have been adopted by a growing number of players to facilitate retail payments.[1] There are broadly two ways[2] in which QR codes can be used for payments.

In the first case, a merchant is given a designated QR code by their acquirer that is linked to their bank account in the backend. Customers must scan the QR code using the camera on their smart device and then enter the amount to be paid and their individual PIN in order to complete the transaction. An example of this method is SnapScan.

In the second case, customers use a company’s interface (a website or app) to select a product, which generates a transaction-specific QR code for the customer. The customer then uses the QR code to collect their purchase in store. These transaction-specific QR codes can also be used to offer loyalty points. An example of this method is the Starbucks app.

But are they well suited for payments?

A QR code is the trademark for a type of matrix (i.e. two dimensional) barcode and the technology was originally invented in 1994 in Japan as a way to track automobile components on the Toyota production line at high speed. In this functionality, QR codes remain highly relevant and continue to be used today for tracking of inventory, shipping, logistics, etc.

But are QR codes well suited to the needs of merchant payment transactions? To answer this question, let us consider two factors often cited in favour of QR codes:

User Experience: There is a general impression that QR codes provide a smooth customer experience. It is true that QR codes can be a quick way to skip the step where a payer has to enter the payee’s account details. By scanning a merchant’s QR code, for example, a customer automatically captures information regarding the merchant’s till number or bank account. However, the payer still must enter the amount to be paid and their security PIN.[3] [4] What then is the value of introducing a new technology that requires significant customer behaviour change and doesn’t really reduce that many steps in the user’s experience?[5]

The answer to the question can be debated, but it would be fair to say that QR codes do not offer a clear advantage over many other channels of payment (such as NFC tags, companion cards or even STK) when it comes to user experience for payments.

Merchant Device: Another positive impression that seems to persist about QR codes is that they can be used by a merchant to accept funds without the need for an acceptance device. Again, this does not present the full picture. It is true that merchants can accept payments via QR codes without a special device when the customer is prepared to scan the code of the merchant (as in the SnapScan example). However, in instances where the customer generates their own transaction-specific QR code from the merchant website or app (as with the Starbucks app), the merchant does need to have special device to scan the QR code when the customer picks up their purchase. Hence the assertion that the merchant does not need an acceptance device for QR code payments is, at best, a half-truth.

Security: Beyond just considerations of user experience and merchant device, there are also serious concerns around the security of QR codes and their susceptibility to fraud. Last month in China for example, criminals reportedly managed to steal $13m by defrauding QR codes[6]. Fraud techniques can range from sophisticated hacking attempts to simply sticking a fraudulent QR code on top of a genuine one (as it is difficult to make it out from the eye whether a QR code really does belong to a particular merchant).

QR codes are not a silver bullet for emerging markets

QR codes can convey the appearance of being a tech-savvy payment channel, offering a smooth customer experience and a low merchant adoption barrier. However, as this blog has attempted to show, this is a skewed image. QR codes do offer some relative strengths over other means of payments, but they also raise some questions.

Providers should exercise caution when considering QR codes for payments in their markets, and bear in mind that a technology originally intended for tracking components on an automobile production line in a developed market need not necessarily offer a silver bullet to solve the challenges of payments in developing countries.

 

	Model 1: Customer Scans Code	Model 2: Merchant Scans Code
Who has the code	Merchant has a designated code (e.g. SnapScan).	Customer has a designated code (e.g. Alipay) or generates a transaction specific code (e.g. Starbucks app).
What the code contains	Merchant payment details (static).	Customer payment details (static) + specific transaction details (dynamic).
Customer experience	Scans merchant code à Enters amount to be paid + PIN à makes payment.   (–) Does not significantly reduce steps compared to other channels e.g. STK.	Generates own QR code à Presents to merchant for scanning à makes payment.   (+) Can be a very smooth experience as money taken directly from account.
Merchant device	Merchant does not need a special device to accept funds as customer scans code.   (+)  Can be a cost effective way to acquire merchants.	Merchant needs a special device to scan individual QR codes generated by customers.   (–) Can pose a significant barrier for merchant acquisition.
Security	(–) Could be compromised by hacking or simply sticking fraudulent QR code on top of genuine one.	(–) Could be compromised by hacking or simply sticking fraudulent QR code on top of genuine one.

 

Notes: 

[1] Last month, the Government of India launched the Bharat QR code in its push towards a cashless economy. SnapScan claims to have “over 25,000 merchants and a vast user network across South Africa.” In 2015, 16% of all Starbucks transactions happened through its QR code-enabled app. Other examples abound.

[2] Variants of these two broad methods also exist e.g. Alipay customers can generate an individual QR code linked to their source of funds, which in-store merchants can scan to accept payments. However, the principle remains the same: QR codes contain either the merchant’s or the customer’s payment (and sometimes transaction) details, and must be scanned by the customer or the merchant respectively to enable a transaction.

[3] See this SnapScan promotional video for the steps involved: https://www.youtube.com/watch?v=UP4eyKQPZdg

[4] In addition, a customer wishing to pay via a QR code also needs: A smartphone with an app that can scan QR codes; a steady hand to scan the merchant QR code; a working internet connection; and of course sufficient ambient light to scan the code.

[5] Even in a relatively simple STK-based merchant payments service like Safaricom’s Lipa Na M-Pesa, entering the merchant’s till number takes just a few seconds. It is a behaviour many mobile money customer populations are deeply comfortable and familiar with.

[6] https://www.techinasia.com/fake-qr-code-scams-china