Common EMV QR Errors and How to Fix Them
Most “the wallet won’t pay” reports are not mysterious. They are CRC, currency, POI, or length bugs. Each section below is a symptom, a cause, a fix, and how to confirm it in the decoder.
CRC failure
Symptom: decoder shows CRC invalid; some apps show a generic invalid QR. Cause: payload edited after checksum, wrong CRC algorithm, or Tag 63 not last. Fix: regenerate CRC over the string including 6304 and excluding the four hex digits. Confirm with a known-good sample from this academy’s payload cookbook.
Alphabetic currency
Symptom: CRC may still pass; wallet rejects or charges the wrong unit. Cause: Tag 53 = INR/USD. Fix: emit 356/840/etc. Confirm Tag 53 length is 03.
POI conflict with amount
Symptom: amount screen missing or amount locked incorrectly. Cause: Tag 01 = 11 with Tag 54, or 12 without Tag 54. Fix: align POI and amount as in the Point of Initiation guide.
TLV length overrun
Symptom: parser throws or later tags look like garbage (merchant name contains city). Cause: length byte too large. Fix: recount value characters; do not pad with spaces unless they are part of the value. Nested MAI lengths must equal the inner TLV total.
Missing merchant account template
Symptom: CRC valid, no payable destination. Cause: no Tag 26–51, or empty GUID. Fix: add the MAI your acquirer specified. A name and city alone cannot route money.
Truncated name or city
Symptom: printed name cuts off; some cert tests fail. Cause: Tag 59 > 25 or Tag 60 > 15. Fix: shorten the doing-business-as string; do not raise the length byte past the spec max and hope.
Test AID in production
Symptom: internal scans work, production wallets do not. Cause: leftover sample GUIDs such as documentation AIDs. Fix: replace with the production GUID from the scheme. Never copy academy sample payloads into live stickers.
How we debug here
Paste the payload into Decode. Read CRC, Tag 01, Tag 53, MAI, 59, 60 in that order. Then regenerate from the EMV studio instead of hex-editing. For field definitions, EMVCo’s QRCPS is the authority; we are not EMVCo.
Country as a name
Tag 58 must be two letters (IN), not INDIA. Length 02. This defect still CRC-passes if you checksum after the mistake.
CRC copied from a sample after an edit
You changed the merchant name, kept 6304A13F from a blog, and Decode says invalid. Recompute CRC last, every time. This is the highest-frequency generator bug we see. Pair it with “Tag 63 not last” and “two CRC tags” from concatenators that append checksums twice. Always one Tag 63 at the end.
If CRC is valid and the app still refuses, stop recomputing checksums. You have a GUID, membership, or camera problem. Jump to interoperability or testing; more CRC work will not help.
Alphabetic Tag 53 and country as a name
Tag 53=INR or USD looks friendly and is wrong. Wallets want 356, 840, and other numeric ISO 4217 codes. The object can still CRC. Tag 58=INDIA or THAILAND is the sibling defect: it must be two letters (IN, TH) with length 02. Decode flags both because they survive checksums and fail payment.
Fix by picking from the generator lists, then re-verify CRC. Do not patch strings in a text editor unless you also fix lengths and checksum.
POI conflict, length overrun, missing MAI
Tag 01=11 with Tag 54, or 12 without 54, is undefined across wallets — fail it in your validator. Length overrun after MAI swallows later tags so the merchant name looks like a GUID fragment; fix the outer MAI length. Missing 26–51 means there is no destination; some UIs still draw a QR. Test AID / cookbook GUID in production is a launch defect, not a styling issue.
Truncated name or city: the UI cap exists because TLV lengths are two digits and wallets display Tag 59 to humans. If you paste a 40-character legal name, you must abbreviate, not hope the QR “absorbs” it.
How we debug on this site
Paste the raw string into Decode. Read CRC, then Tag 53 type, then Tag 01 versus 54, then MAI tree, then 59/60. Photograph plus string when a shop asks for help: photos compress, strings do not. Do not email live production payloads to a public ticket if they contain real account proxies; redact the MAI in screenshots if you must share.
Official field rules: EMVCo QRCPS on emvco.com. This hall of fame is from independent toolkit usage, not from an EMVCo lab report.
Editor anti-patterns
Do not fix TLV in Excel, do not strip leading zeros to “save space,” do not concatenate two payloads to “merge accounts,” and do not paste a UPI URI into Tag 59. Each of those produces either CRC invalid or CRC-valid fraud bait. Use the generator or a single serializer library, then Decode. If you must hand-edit for an emergency, recompute every length and CRC before you reprint.
Weekly review of Decode tickets
If the same defect appears three times in a week (alphabetic Tag 53, copied CRC, 11+54), add an automated validator rule and a validation-examples fixture. Common errors should shrink over time; if they do not, your CMS is letting operators edit raw TLV.
Close the loop with validation-examples
Every new common error should become a named fail fixture within a week. If it stays “tribal knowledge,” the next hire will repeat it. Link support macros to the validation page.