FAQ: QR Code – General & Technical Questions

EMV® QR Codes Frequently Asked Questions (FAQ) Background: To satisfy the need for global interoperability and security, EMVCo has launched specifications for QR Code payments. The work supports EMVCo’s goal of global interoperability by leveraging the existing EMV specifications and capabilities to facilitate adoption. 1. Why is EMVCo focusing on QR Code payment? With the increasing deployment of QR Code payment methods, it is important that the payments ecosystem provides a consistent experience for merchants and consumers. Given its early stage of deployment and growing adoption, now is the time to ensure the technology’s potential is not constrained in the future due to compatibility issues. An effective solution to ensure global interoperability for established payment methods has come through the development and implementation of global specifications. EMVCo is the global technical body that facilitates the worldwide interoperability and acceptance of secure payment transactions by managing and evolving the EMV®* Specifications and related testing processes. Adoption of EMV Specifications and associated approval and certification processes promote a unified international payments framework, supporting payment methods, technologies and acceptance environments. EMVCo is uniquely positioned to manage and evolve the global specifications for QR Code payments given its proven experience in defining and certifying secure payment methods. 2. At a high level, what is EMVCo doing in this area? EMVCo commenced its QR Code payments activity in 2016. EMVCo has focused on creating QR Code payment specifications that provide convenience, security and reliability in line with other EMV Specifications. The EMV QR Code Specifications intend to enable collaboration with industry participants and reflect the requirements of actors across the payments ecosystem. © 2023 EMVCo, LLC. All rights reserved. Page 1 3. What does this mean specifically? Two specifications have been developed to address the two dominant QR Code payment use cases: consumer-presented QR Codes and merchant-presented QR Codes. • With the consumer-presented mode, the customer displays the QR Code on their mobile device and the merchant uses an optical scanner to scan the QR Code. • With merchant-presented mode, the merchant displays the QR Code and the consumer uses their mobile device to scan the QR Code. 4. How will EMVCo’s work with QR Codes benefit the payments industry? The EMV QR Code Specifications simplify the development and potentially broaden the acceptance of both consumer-presented and merchant-presented QR Code payment solutions. For consumer-presented mode, solution providers benefit from the ability to openly develop and implement solutions with compatibility with the existing EMV payments ecosystem and infrastructure. Those who have already developed proprietary solutions have the option to migrate to the globally interoperable EMV framework to widen acceptance points. The specification enables merchants to accept several QR Code payment solutions from various providers in a standardised manner. Consumers will benefit from a more consistent user experience, increased convenience and wider choice. In addition, QR Code payments will enable consumers to access alternative payment methods, without necessarily requiring high-end devices with advanced functionality. 5. What steps are being taken to ensure the new specifications are as secure as they need to be? EMVCo has and will continue to leverage the existing infrastructure and its experience to align the security for QR Code payments with its established specifications. It will also align with security requirements identified through EMVCo’s current activity regarding Software-Based Mobile Payments. © 2023 EMVCo, LLC. All rights reserved. Page 2 For consumer-presented mode, the specification is compatible with EMV Payment Tokenisation. 6. Will the specification be available to all parties without charge? Yes. The EMV QR Code Specifications will be available to all industry participants, on a royalty-free basis and are designed to promote global interoperability and help prevent fraud. EMVCo has an established process for delivering payment specifications through open and transparent processes in consultation with industry stakeholders. 7. Will EMVCo be offering a supportive testing infrastructure? As part of its ongoing work to facilitate worldwide acceptance and interoperability for EMV QR Code payments, EMVCo has developed self-evaluation processes for both the consumer-presented and merchant-presented specifications. The platforms, available to all EMVCo Associates and Subscribers, allow point of interaction (POI) implementers to confirm whether their QR Codes are generated or interpreted in compliance to the EMV QR Code Specifications. As it is a self-evaluation process, EMVCo will not provide certification or approvals. 8. How will the specifications be adopted by payment systems and other payments stakeholders? As an organisation striving to facilitate enhanced security and interoperability through standardisation within the payments ecosystem, EMVCo plays an important role in bringing together stakeholder interests among payments industry participants. However, EMVCo does not establish obligations, requirements, or otherwise regarding the adoption and implementation of its specifications. EMVCo does not mandate or enforce EMV compliance or the implementation policies for issuers, merchants and acquirers, which are handled by payment systems independently outside of EMVCo. To learn more about the role EMVCo plays within the payments ecosystem, please read the EMVCo Operating Principles found in the “About EMVCo” section of the website. 9. Will other industry stakeholders be able to provide input to the new QR Code payments specifications? © 2023 EMVCo, LLC. All rights reserved. Page 3 Yes. EMVCo has an established Associates Programme that is open to industry stakeholders. EMVCo’s current practice is to engage with its Associates to confirm understanding of requirements to support global interoperability and security. EMVCo will be seeking input from Associates, at both a technical and business level, to enable global requirements to be addressed. EMVCo welcomes new participants who are interested in contributing to the QR Code payments effort to join the Associates Programme. To find out more, visit the EMVCo website’s “Ways to Participate” section. 10. Why has EMVCo developed a QR Payment Mark and QR Scan Icon, and what are the requirements for their placement? The creation of the QR Payment Mark and QR Scan Icon aims to promote global interoperability awareness across EMV QR Code payments. EMVCo has developed reproduction requirements and a royalty-free license agreement to enable all implementers of EMV QR Code solutions to use the respective Marks. The QR Payment Mark may be used to inform consumers that a merchant accepts EMV QR Code payment solutions. Supplemental messaging to consumers will confirm whether merchant-presented transactions, consumer-presented transactions, or both, are supported. The QR Payment Mark may also be used for in-app purchases on a mobile device to click and generate a consumer-presented QR Code. The QR Scan Icon may be used for in-app purchases on mobile devices, to indicate that the consumer may scan a merchant-presented QR Code. The QR Scan Icon may not be used as an acceptance mark at point of sale for consumer-presented or merchant-presented transactions. A royalty-free trademark license agreement and reproduction requirements are available in EMVCo’s Trademark Centre. 11. Do the EMV QR Code Specifications apply to all QR Codes? QR Codes are a general purpose machine readable data format which can read by a camera. QR Codes are used in a wide variety of applications across many domains, including directing users to a shopping or information website, product identification, asset tracking and more. The EMV QR Code Specifications on the other hand are domain specific. They define an interoperable format for communicating data required for payments to occur. For example, a consumer initiates payment from a Mobile application, such as a © 2023 EMVCo, LLC. All rights reserved. Page 4 banking app or a third-party provided payment app, by presenting a QR Code (consumer presented QR) or scanning a QR Code (merchant presented QR). 12. Does the EMV Merchant Presented QR Code Specification require a mobile app? The EMV Merchant Presented QR Code Specification defines an interoperable and domain-specific format for communicating the data from the merchant to the consumer in a structured manner to initiate a payment; such data is payment specific and does not have a general purpose, unlike a uniform resource locator (URL). Consequently, a specific mobile app is generally required to process the information in the EMV QR Code and to conduct the payment itself. A generic QR Code reader such as the mobile operating system provided camera application is generally not usable with the EMV Merchant Presented QR Code Specification. In Merchant-Presented mode, the Mobile application/wallet reads and parses QR Code payload which is compliant with the specification, and sends the transaction initiation request to the Network. * EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC. QR Code is a registered trademark of DENSO WAVE. © 2023 EMVCo, LLC. All rights reserved. Page 5