QR code payments

The European Payments Council first released its QR code guidelines for the SEPA credit transfer in 2012, and version 3.1 of the guidelines has applied since 19 March 2024. The document is informative, so each bank decides whether its app reads the code, and it fits invoices where the same payment data also appears in plain text for the payer to compare. The German savings banks call this code GiroCode, and the Sparkasse app reads payee, IBAN, BIC, amount and reference (in German) from the invoice before the customer approves the transfer with a TAN.

The code holds text lines in a fixed order: the service tag BCD, the version 001 or 002, a character set, the identifier SCT, the BIC, the name of the payee and the IBAN. Optional lines carry the amount in euros, a purpose code and either a structured creditor reference or a free text of up to 140 characters, and the whole payload may not exceed 331 bytes. In version 002 the BIC is optional and stays mandatory only for payments that involve scheme participants from outside the EEA. For a payment where the payee shows nothing but the code, at a shop terminal or on the cart page of an online shop, the EPC refers payees to a separate standard.

For payments at the point of interaction, the EPC document Standardisation of QR-codes for MSCTs defines a payee-presented and a payer-presented code for payments between people, from consumers to businesses and between businesses. A code shown by the payee can carry a token that the provider of the payee resolves, a proxy for the payee data, or all transaction data in clear text, including name, IBAN, merchant category code and amount. A code shown by the payer carries only a token, because two answers of the European Banking Authority rule out the options with a customer identifier in clear text.

Every code under this standard is a web address built from the domain of the scheme, a version, a type, the identifier of the provider and the payload. One code can hold several payloads, so a shop can accept more than one payment app with a single sticker or screen. Bizum in Spain uses the consumer-presented mode at the lottery outlets of Loterías y Apuestas del Estado, where the customer creates a QR code in the banking app that stays valid for 15 minutes and an employee scans it.

The work goes back to a statement of the Euro Retail Payments Board, which asked the EPC in June 2021 for QR codes that let instant payments work across schemes at the point of interaction. The EPC answered with the document EPC212-21 in 2021, and its multi-stakeholder group on mobile initiated SEPA credit transfers turned it into a standard for all payment contexts, published in January 2023. Version 2.10 of 17 June 2024 states that any payment scheme or payment solution may use the format, including one that runs on neither SCT Inst nor SCT.

The standard sets the format and leaves the implementation to each scheme, so a shop still needs a provider that connects it to the apps of its customers. The European Payments Alliance and the European Payments Initiative plan to connect their national apps and Wero through one hub, with payments in stores in a later phase. The digital euro app of the ECB also lists QR code payments in shops among its first functions.

Switzerland replaced its payment slips with the QR-bill, which SIX introduced on 30 June 2020 for the Swiss financial center. The QR-bill consists of a payment part and a receipt, and its Swiss QR Code contains all the data needed for invoicing and for payment. PostFinance set 30 September 2022 as the end date of the red and orange inpayment slips for all Swiss banking customers. Customers of PostFinance and the other Swiss banks scan the QR-bill in their mobile or e-banking apps.

In Belgium, Wero has reached the shop counter, and shoppers scan a Wero QR code on a screen, a sticker or a poster (in French) before they check the payee name and the amount and confirm. The European Payments Initiative named Payworld as a provider whose Belgian payment terminals display the Wero code, and old Payconiq QR codes on invoices and in stores keep working through Wero until the end of 2026. The European Payments Initiative runs Wero, and in Germany the wallet already works for online shopping.

Quishing is phishing with a QR code that leads to a fake website or starts the download of malware. BaFin warned on 7 October 2024 (in German) that fraudsters send letters that claim to come from banks, and that they also reach people by email, SMS and WhatsApp. BaFin advises scanning a code only when the destination is certain and setting the smartphone to display a link before it opens.

Static codes printed on parking machines are the second target of quishing in Germany. The Frankfurt police found at least eight stickers (in German) over the codes of the parking app easypark in the Nordend and Westend districts at the end of June 2026, and the fake pages asked for credit card details. The police advise checking that a code is part of the printed label and that the domain matches the provider. The EPC standard recommends integrity protection for data in clear text and separates static codes on stickers from dynamic codes that are valid for one transaction. Hectronic supplies payment systems for charging stations and parking machines, and its devices show a new Wero code on the display for every payment, which by the assessment of EPI makes quishing with overlaid codes virtually impossible.

An invoicing program or a GiroCode generator writes the lines in the order of the EPC guidelines and encodes them as a QR code with error correction level M, up to version 13. The EPC guidelines are written for invoices that also show payee, IBAN, amount and reference in plain text, so the payer can compare both. A test scan with a banking app before the first invoice goes out shows whether every field arrives in the transfer form.

The QR code only fills in the payment, and the payer still approves it in the banking app with strong customer authentication. The risk lies in a code that leads to a fake website, so the payer should compare the payee name and the amount in the app before approving. For a SEPA transfer, banks in the euro area have also had to offer a verification of payee since 9 October 2025, which compares the name of the payee with the IBAN.

GiroCode is the name that German banks use for the EPC QR code, which starts a SEPA credit transfer in euros. The Swiss QR-bill is a separate standard of SIX with its own Swiss QR Code, and it consists of a payment part and a receipt. The Swiss QR Code also carries the data for booking the invoice, while the EPC code holds the fields of one transfer.

Wero, the wallet of the European Payments Initiative, works in Germany for online payments and in specific physical payment settings such as charging stations for electric cars. EPI plans broader availability at shop checkouts in Germany and France from 2027 onwards, after the start in Belgian stores with QR codes on payment terminals.