QR code payment system, a game changer?

• Quick response codes began to be used much more for payments when WeChat and Alipay in China started offering proprietary versions in late 2011
• Outside of China, usage of QR codes for payments had grown slowly in the past years
• A number of banks and payments industry players are reviewing their strategies to take full advantage of this payments alternative

A quick response code (QR code) is a two-dimensional code made up of black and white squares that can be read by smartphone cameras, point of sale (POS) terminals or other devices. While the QR code was first invented for the automotive industry in Japan and patented by Toyota subsidiary Denso Wave, anyone can use QR codes as long as they follow the code standards.

QR code usage has exploded over the past half-dozen years, as multitudes of companies began using them for everything from advertising and promotions to merchandise tracking and coupons, and more. Consumers are increasingly using QR codes to access media on the Internet, download offers, find product information and more.

QR codes have also started to be used for payments, with customers making payments by scanning a QR code and having the amount transferred directly from their account to the merchant, without the need for a POS terminal.

QR codes became popular first in China

While QR codes have been used for payments at Starbucks and other retailers for nearly a decade, they began to be used much more for payments when WeChat and Alipay in China started offering proprietary versions in late 2011. While it took some time for QR code payments to become popular in China, and the companies faced setbacks in 2014 when fraudulent QR codes caused the Chinese government to ban QR code payments temporarily, WeChat and Alipay strengthened their controls and QR code payments continued to gain traction.

Propelled by promotions by Alipay and Tencent, such as WeChat promoting QR codes to replace red packets for Chinese New Year, QR code payment volumes in China have exploded over the past three years. And along with encouraging potential business customers such as taxi drivers to use QR codes, Alipay has also marketed hardware products that support QR code payments.

The lack of payments infrastructure in China has made the rollout of relatively inexpensive QR code payments more compelling. While purchasing millions of POS terminals would have been prohibitively expensive, QR codes are inexpensive and merchants increasingly been adopting them for payments. The growing prevalence of smartphones in China has given consumers even more reasons to use QR codes for payments and also created an ecosystem effect, resulting in social behaviour changing and QR codes becoming a way of life.

That doesn’t mean it’s all smooth sailing. After usage of fraudulent QR codes that infected smartphones with viruses led to theft totalling $13 million in early 2017, for instance, the security of QR codes started coming under fresh scrutiny.

The new card scheme - catalyst for QR code payments

That rapid growth of QR code payments in China did not, however, immediately translate into usage in other markets. Indeed, QR codes were often seen as a low-tech high-risk solution not worthy of emulation. Over the past year or so, that perception has shifted.

One of the first major changes came in 2016, when Visa launched a mobile payments application in Kenya as a challenge to incumbent M-PESA. In partnership with four large banks, it launched mVisa to enable consumers to make payments by scanning a merchant’s QR code. Visa then began expanding the service, announcing in February 2017 at the Mobile World Congress in Barcelona that mVisa was live in India, Kenya and Rwanda and would soon be available in Egypt, Ghana, Indonesia, Kazakhstan, Nigeria, Pakistan and Vietnam.

Not to be outdone, MasterCard rolled out Masterpass QR in Nigeria, Ghana, Rwanda, Uganda and Tanzania, and said it would “soon be in a number of countries across the continent” (Figure 1).

And after banks were largely left out of QR code payments in China, focusing instead on NFC payments such as Apple Pay or Mi Pay that are usable at traditional POS terminals, UnionPay finally launched its QuickPass QR payments in May 2017 in China and soon extended the service to Hong Kong and Singapore. It is important to note that these offerings had largely been proprietary systems and were not interoperable.

The India story – a new model for interoperability

This year, the biggest story is in India. In February, India launched Bharat QR, which it called the world’s first fully interoperable QR code payments. Developed by the National Payments Corporation of India (NPCI) together with MasterCard and Visa, Bharat QR overcomes the limitations of closed loop QR code-based acceptance. A new merchant category has even been created for Bharat QR in India, with the merchant discount rate (MDR) capped at 0.4%.

Along with expanding usage from the 50-60 banks expected to join Bharat QR in 2017 to perhaps 600 banks in future years, further enhancements seem likely. One is for Bharat QR to link with the Unified Payments Interface (UPI), an app which enables person-to-person payments.

Another could be to allow wallets such as Paytm, a pioneer in proprietary QR code payments in India, to join the network.

The Reserve Bank of India told banks to install one million more terminals at merchants in the first half of 2017, leading to a forecast of more than two million bank-acquired merchants by the end of 2017. Paytm, which added about one million merchants within two months after the end of demonetisation in India in 2016, and targets five million merchants by the end of 2017 (Figure 2).

QR code growth in other markets

Outside of China, and now India and Kenya, usage of QR codes for payments had grown slowly. In the US, for instance, market-wide solutions such as MCX have lagged, and even the purchase of MCX by JP Morgan Chase recently has not propelled QR code acceptance rapidly.

Two banks in Singapore, DBS and OCBC, have rolled out their own proprietary QR code acceptance solutions. Momentum is, however, beginning to grow. Along with the rollouts announce for Africa and other markets, MasterCard, UnionPay and Visa recently introduced an interoperable QR code payments platform in Thailand that is targeted to be implemented across Thailand by the third quarter of 2017. With other launches by Visa and MasterCard already announced, and with interoperability growing, a wave of new QR code payments program rollouts seem far more likely than it did just a few short months ago.

Once banks do decide to launch interoperable QR code payments, the process is straightforward. Banks have developed QR code payment solutions and integrated them into their existing bank apps, then rolled it out to consumers and merchants with a slew of announcements and straightforward guides for implementation. With so many individuals using apps and even using QR codes for shopping or payments in other channels, many consumers and merchants have intuitively adopted QR code for payments quite quickly.

Potential pitfalls

All the benefits of QR codes and the tremendous growth in volumes don’t mean that QR code payments don’t have any downsides. Indeed, QR code payments can expose users to fraud. Viruses in QR codes can capture personal information, for instance, and hackers can break into mobile devices to steal account information. Since there is no way for most consumers to know whether a QR code will link them to malware, infected QR code problems have begun to emerge.

That said, WeChat and Alipay in China as well as card schemes and acquirers in other countries are developing new ways to protect QR code users. Alipay said that it has a technology which determines whether a QR code is generated by its own system and will send a message allowing users to determine whether to proceed with the payment if it detects a risk. Tencent is similarly enhancing its security measures and educating consumers about the risks.

Case studies

MasterCard

MasterCard started working on QR codes for payment acceptance about 18 months ago, Jason Tymms, vice president for market product management at MasterCard, said. The development has been driven
especially by consumers wanting immediacy and more places to pay, and by merchants wanting to accept more payments, as well as by lower capital costs.

Key use cases, Tymms said, vary depending on the market. Consumers in India frequently use QR codes for payment on delivery for online orders, for instance, while consumers in Vietnam use QR codes to pay for taxis. Consumers in Indonesia use QR codes for bill payments, since scanning the QR code on the bill and making a payment solves a pain point of having to walk somewhere to make a payment.

While the QR codes in markets such as India and Thailand are interoperable, they are still waiting for ratification from EMVCo, a governing body for the payments industry. Once the standard is approved, other entities that wish to leverage interoperable QR codes can do so because standards will be publicly available.

While there has been fraud in China around the QR code, Tymms said the technology for the interoperable QR codes that MasterCard uses is different. There are security elements in the QR code as well as a check digit, and merchants have credentials that are registered only to receive payments to them. If someone extracts payment credentials, false credentials that are not specific to the merchant could not be used. The basic transaction is also controlled by a mobile phone, authentication such as biometric identification is needed, and MasterCard uses tools such as network rules and velocity parameters
to prevent fraud.

Merchant education is very simple, Tymms said. Merchants simply need to display a QR code and have it scanned, then receive notification though an app or text message to confirm the payment. For consumers, the QR button is on the screen and usage is straightforward. For the programs going live in Africa and Asia, Tymms noted, the QR code is in the mobile banking application, “without exception.”

Axis Bank

Development of QR codes for payments in India has been going on for more than a year, head of cards and merchant Acquiring Business at Axis Bank Sangram Singh said. It started in early 2016 with Visa’s mVisa, whereby a merchant would display a QR code and the customer would use a bank’s mobile app to make a payment. At about the same time, Singh said, banks began having discussions with MasterCard and RuPay as well about using standardised specifications for QR code payments.

Once demonetisation started and the focus on digital payments increased, regulators jumped in and helped facilitate interactions. The card schemes then came out with Bharat QR, a single specification which any acquirer can use to create a QR code and which consumers can use with any of the three types of cards.

The key difference between India and other countries, Singh noted, is interoperability. Whereas QR codes from Paytm in India or wallets in China are closed loop, Bharat QR enables consumers and merchants to use their current payment instruments rather than forcing them to something else. The intent was to provide the same level of interoperability that currently exists in the entire card payment industry.

Consumers currently use QR codes for two main purposes, Singh said. One is “push payments”, whereby consumers scan a QR code on a bill and push a payment to a company. The second is at small merchants. “As we get big merchants on,” Singh opined, “we will see more consumer adoption happening” as consumers get accustomed to using QR codes and start to use them at small outlets such as cabs or vegetable vendors.

The economic rationale for QR codes, Singh said, stemmed from the difficulty banks had in acquiring smaller merchants. It was difficult to support those merchants with standard terminals, which are not designed to do a few transactions a day. The QR code eliminates the need for large expenditures, as merchants can either use a sticker with a QR code or download the merchant app and create a QR code to accept digital payments. Usage of QR codes is secure, Singh explained, because it starts on the consumer side from the banking app, where there is a high level of security. “The level of risk is the same as in the mobile app.”

A key goal of Bharat QR, Singh explained, is getting really small merchants into the digital payments fold. In India today, there are approximately 800 million debit cards and 30 million credit cards. “The intent, for small merchants, is to give them a manner they can accept digital payment. As they increase transaction count and get more comfortable, these merchants can upgrade to mobile POS, (then) to standard POS. There’s a journey.”

What QR codes do, he noted, is to allow rapid expansion of points of acceptance without having to incur wasteful expenditures.

Strategic implications of QR codes

The rapid expansion of usage of QR codes for payments has a multitude of implications for banks and card schemes as well as for other industry players. Companies will need to decide how to play and develop new strategies quickly to stay in the game. One impact is the shift towards interoperability.

Whereas Alipay and Tenpay in China as well as the initial versions of mVisa used proprietary QR codes, usage of interoperable QR code payments is growing. These interoperable solutions bring tremendous efficiency to merchants and better scalability for banks. Card schemes as well as wallets such as Alipay and WeChat Pay that have proprietary QR code payments services will need to decide whether to shift towards full interoperability so that they can offer a seamless payment experience globally or continue to try to preserve their turf by offering proprietary solutions.

Another key impact of QR codes could be their effect on near field communication (NFC) payments. While Apple Pay and Samsung Pay as well as other “Pay” solutions have launched with great fanfare, actual usage of NFC contactless services has often been low. Moreover, merchants usually need to install a contactless card reader or upgrade their POS terminal to accept NFC payments. Industry players may need to rethink their payments strategy in light of the new QR code options, and handset manufacturers may need to consider what to do with NFC if QR code usage begins to expand faster.

More broadly, QR codes could have a tremendous impact on financial inclusion and bank liability products. One of the difficulties for consumers in remote areas has been using digital money, even if they have a plastic card or a phone. POS terminals were often too expensive to install in sufficient numbers to make card or even mobile payments viable. Now, QR codes give merchants a cheap and easy way to accept digital payments. Once QR code payment acceptance becomes more broadly available, it will be easier for consumers to use money they store on their phone.

Whatever happens, QR codes have opened up more options for more payments more quickly than many people expected, and banks as well as other payments industry players will need to review their strategies quickly to take full advantage of this rapidly-emerging payments alternative.