QR code payment system, a game changer?

By Richard Hartung

Globally, banks and non-banks are testing whether QR codes to merchants and
consumers can provide a simple solution for payments.

 Quick response codes began to be used much more for payments when WeChat
and Alipay in China started offering proprietary versions in late 2011
 Outside of China, usage of QR codes for payments had grown slowly in the
past years
 A number of banks and payments industry players are reviewing their
strategies to take full advantage of this payments alternative
A quick response code (QR code) is a two-dimensional code made up of black
and white squares that can be read by smartphone cameras, point of sale
(POS) terminals or other devices. While the QR code was first invented for the
automotive industry in Japan and patented by Toyota subsidiary Denso Wave,
anyone can use QR codes as long as they follow the code standards.

QR code usage has exploded over the past half-dozen years, as multitudes of
companies began using them for everything from advertising and promotions
to merchandise tracking and coupons, and more. Consumers are increasingly
using QR codes to access media on the Internet, download offers, find product
information and more.
QR codes have also started to be used for payments, with customers making
payments by scanning a QR code and having the amount transferred directly
from their account to the merchant, without the need for a POS terminal.

QR codes became popular first in China

While QR codes have been used for payments at Starbucks and other retailers
for nearly a decade, they began to be used much more for payments when
WeChat and Alipay in China started offering proprietary versions in late 2011.
While it took some time for QR code payments to become popular in China,
and the companies faced setbacks in 2014 when fraudulent QR codes caused
the Chinese government to ban QR code payments temporarily, WeChat and
Alipay strengthened their controls and QR code payments continued to gain
traction.

Propelled by promotions by Alipay and Tencent, such as WeChat promoting

QR codes to replace red packets for Chinese New Year, QR code payment
volumes in China have exploded over the past three years. And along with
encouraging potential business customers such as taxi drivers to use QR codes,
Alipay has also marketed hardware products that support QR code payments.

The lack of payments infrastructure in China has made the rollout of relatively
inexpensive QR code payments more compelling. While purchasing millions of
POS terminals would have been prohibitively expensive, QR codes are
inexpensive and merchants increasingly been adopting them for payments.
The growing prevalence of smartphones in China has given consumers even
more reasons to use QR codes for payments and also created an ecosystem
effect, resulting in social behaviour changing and QR codes becoming a way of
life.

That doesn’t mean it’s all smooth sailing. After usage of fraudulent QR codes
that infected smartphones with viruses led to theft totalling $13 million in
early 2017, for instance, the security of QR codes started coming under fresh
scrutiny.

The new card scheme - catalyst for QR code payments

That rapid growth of QR code payments in China did not, however,

immediately translate into usage in other markets. Indeed, QR codes were
often seen as a low-tech high-risk solution not worthy of emulation. Over the
past year or so, that perception has shifted.

One of the first major changes came in 2016, when Visa launched a mobile
payments application in Kenya as a challenge to incumbent M-PESA. In
partnership with four large banks, it launched mVisa to enable consumers to
make payments by scanning a merchant’s QR code. Visa then began
expanding the service, announcing in February 2017 at the Mobile World
Congress in Barcelona that mVisa was live in India, Kenya and Rwanda and
would soon be available in Egypt, Ghana, Indonesia, Kazakhstan, Nigeria,
Pakistan and Vietnam.

Not to be outdone, MasterCard rolled out Masterpass QR in Nigeria, Ghana,

Rwanda, Uganda and Tanzania, and said it would “soon be in a number of
countries across the continent” (Figure 1).

And after banks were largely left out of QR code payments in China, focusing
instead on NFC payments such as Apple Pay or Mi Pay that are usable at
traditional POS terminals, UnionPay finally launched its QuickPass QR
payments in May 2017 in China and soon extended the service to Hong Kong
and Singapore. It is important to note that these offerings had largely been
proprietary systems and were not interoperable.

The India story – a new model for interoperability

This year, the biggest story is in India. In February, India launched Bharat QR,
which it called the world’s first fully interoperable QR code payments.
Developed by the National Payments Corporation of India (NPCI) together
with MasterCard and Visa, Bharat QR overcomes the limitations of closed loop
QR code-based acceptance. A new merchant category has even been created
for Bharat QR in India, with the merchant discount rate (MDR) capped at
0.4%.

Along with expanding usage from the 50-60 banks expected to join Bharat QR
in 2017 to perhaps 600 banks in future years, further enhancements seem
likely. One is for Bharat QR to link with the Unified Payments Interface (UPI),
an app which enables person-to-person payments.

Another could be to allow wallets such as Paytm, a pioneer in proprietary QR

code payments in India, to join the network.

The Reserve Bank of India told banks to install one million more terminals at
merchants in the first half of 2017, leading to a forecast of more than two
million bank-acquired merchants by the end of 2017. Paytm, which added
about one million merchants within two months after the end of
demonetisation in India in 2016, and targets five million merchants by the end
of 2017 (Figure 2).

QR code growth in other markets

Outside of China, and now India and Kenya, usage of QR codes for payments
had grown slowly. In the US, for instance, market-wide solutions such as MCX
have lagged, and even the purchase of MCX by JP Morgan Chase recently has
not propelled QR code acceptance rapidly.

Two banks in Singapore, DBS and OCBC, have rolled out their own
proprietary QR code acceptance solutions. Momentum is, however, beginning
to grow. Along with the rollouts announce for Africa and other markets,
MasterCard, UnionPay and Visa recently introduced an interoperable QR code
payments platform in Thailand that is targeted to be implemented across
Thailand by the third quarter of 2017. With other launches by Visa and
MasterCard already announced, and with interoperability growing, a wave of
new QR code payments program rollouts seem far more likely than it did just a
few short months ago.

Once banks do decide to launch interoperable QR code payments, the process

is straightforward. Banks have developed QR code payment solutions and
integrated them into their existing bank apps, then rolled it out to consumers
and merchants with a slew of announcements and straightforward guides for
implementation. With so many individuals using apps and even using QR
codes for shopping or payments in other channels, many consumers and
merchants have intuitively adopted QR code for payments quite quickly.

Potential pitfalls

All the benefits of QR codes and the tremendous growth in volumes don’t
mean that QR code payments don’t have any downsides. Indeed, QR code
payments can expose users to fraud. Viruses in QR codes can capture personal
information, for instance, and hackers can break into mobile devices to steal
account information. Since there is no way for most consumers to know
whether a QR code will link them to malware, infected QR code problems have
begun to emerge.

That said, WeChat and Alipay in China as well as card schemes and acquirers
in other countries are developing new ways to protect QR code users. Alipay
said that it has a technology which determines whether a QR code is generated
by its own system and will send a message allowing users to determine
whether to proceed with the payment if it detects a risk. Tencent is similarly
enhancing its security measures and educating consumers about the risks.

Case studies

MasterCard

MasterCard started working on QR codes for payment acceptance about 18

months ago, Jason Tymms, vice president for market product management at
MasterCard, said. The development has been driven
especially by consumers wanting immediacy and more places to pay, and by
merchants wanting to accept more payments, as well as by lower capital costs.

Key use cases, Tymms said, vary depending on the market. Consumers in
India frequently use QR codes for payment on delivery for online orders, for
instance, while consumers in Vietnam use QR codes to pay for taxis.
Consumers in Indonesia use QR codes for bill payments, since scanning the
QR code on the bill and making a payment solves a pain point of having to
walk somewhere to make a payment.

While the QR codes in markets such as India and Thailand are interoperable,
they are still waiting for ratification from EMVCo, a governing body for the
payments industry. Once the standard is approved, other entities that wish to
leverage interoperable QR codes can do so because standards will be publicly
available.

While there has been fraud in China around the QR code, Tymms said the
technology for the interoperable QR codes that MasterCard uses is different.
There are security elements in the QR code as well as a check digit, and
merchants have credentials that are registered only to receive payments to
them. If someone extracts payment credentials, false credentials that are not
specific to the merchant could not be used. The basic transaction is also
controlled by a mobile phone, authentication such as biometric identification
is needed, and MasterCard uses tools such as network rules and velocity
parameters
to prevent fraud.

Merchant education is very simple, Tymms said. Merchants simply need to

display a QR code and have it scanned, then receive notification though an app
or text message to confirm the payment. For consumers, the QR button is on
the screen and usage is straightforward. For the programs going live in Africa
and Asia, Tymms noted, the QR code is in the mobile banking application,
“without exception.”

Axis Bank

Development of QR codes for payments in India has been going on for more
than a year, head of cards and merchant Acquiring Business at Axis Bank
Sangram Singh said. It started in early 2016 with Visa’s mVisa, whereby a
merchant would display a QR code and the customer would use a bank’s
mobile app to make a payment. At about the same time, Singh said, banks
began having discussions with MasterCard and RuPay as well about using
standardised specifications for QR code payments.

Once demonetisation started and the focus on digital payments increased,

regulators jumped in and helped facilitate interactions. The card schemes then
came out with Bharat QR, a single specification which any acquirer can use to
create a QR code and which consumers can use with any of the three types of
cards.

The key difference between India and other countries, Singh noted, is
interoperability. Whereas QR codes from Paytm in India or wallets in China
are closed loop, Bharat QR enables consumers and merchants to use their
current payment instruments rather than forcing them to something else. The
intent was to provide the same level of interoperability that currently exists in
the entire card payment industry.

Consumers currently use QR codes for two main purposes, Singh said. One is
“push payments”, whereby consumers scan a QR code on a bill and push a
payment to a company. The second is at small merchants. “As we get big
merchants on,” Singh opined, “we will see more consumer adoption
happening” as consumers get accustomed to using QR codes and start to use
them at small outlets such as cabs or vegetable vendors.

The economic rationale for QR codes, Singh said, stemmed from the difficulty
banks had in acquiring smaller merchants. It was difficult to support those
merchants with standard terminals, which are not designed to do a few
transactions a day. The QR code eliminates the need for large expenditures, as
merchants can either use a sticker with a QR code or download the merchant
app and create a QR code to accept digital payments. Usage of QR codes is
secure, Singh explained, because it starts on the consumer side from the
banking app, where there is a high level of security. “The level of risk is the
same as in the mobile app.”

A key goal of Bharat QR, Singh explained, is getting really small merchants
into the digital payments fold. In India today, there are approximately 800
million debit cards and 30 million credit cards. “The intent, for small
merchants, is to give them a manner they can accept digital payment. As they
increase transaction count and get more comfortable, these merchants can
upgrade to mobile POS, (then) to standard POS. There’s a journey.”

What QR codes do, he noted, is to allow rapid expansion of points of

acceptance without having to incur wasteful expenditures.

Strategic implications of QR codes

The rapid expansion of usage of QR codes for payments has a multitude of

implications for banks and card schemes as well as for other industry players.
Companies will need to decide how to play and develop new strategies quickly
to stay in the game. One impact is the shift towards interoperability.

Whereas Alipay and Tenpay in China as well as the initial versions of mVisa
used proprietary QR codes, usage of interoperable QR code payments is
growing. These interoperable solutions bring tremendous efficiency to
merchants and better scalability for banks. Card schemes as well as wallets
such as Alipay and WeChat Pay that have proprietary QR code payments
services will need to decide whether to shift towards full interoperability so
that they can offer a seamless payment experience globally or continue to try
to preserve their turf by offering proprietary solutions.

Another key impact of QR codes could be their effect on near field

communication (NFC) payments. While Apple Pay and Samsung Pay as well
as other “Pay” solutions have launched with great fanfare, actual usage of NFC
contactless services has often been low. Moreover, merchants usually need to
install a contactless card reader or upgrade their POS terminal to accept NFC
payments. Industry players may need to rethink their payments strategy in
light of the new QR code options, and handset manufacturers may need to
consider what to do with NFC if QR code usage begins to expand faster.

More broadly, QR codes could have a tremendous impact on financial

inclusion and bank liability products. One of the difficulties for consumers in
remote areas has been using digital money, even if they have a plastic card or a
phone. POS terminals were often too expensive to install in sufficient numbers
to make card or even mobile payments viable. Now, QR codes give merchants
a cheap and easy way to accept digital payments. Once QR code payment
acceptance becomes more broadly available, it will be easier for consumers to
use money they store on their phone.

Whatever happens, QR codes have opened up more options for more

payments more quickly than many people expected, and banks as well as other
payments industry players will need to review their strategies quickly to take
full advantage of this rapidly-emerging payments alternative.