QR Code Security Best Practices
A valid CRC does not mean a trustworthy payee. QR payments fail open if people treat the code as a signature. This page is about attacks we see on merchant-presented codes and how to reduce them without changing how EMVCo TLV works.
CRC is integrity, not identity
Anyone can build a well-formed MPM string that pays their own VPA or MAI and compute a correct Tag 63. Integrity checks stop corruption, not substitution. Never skip a visual check of merchant name and amount because “the QR decoded fine.”
Sticker overlay and replacement
Attackers place a second sticker on the merchant’s printed QR. The camera sees only the top code. Defense: merchants should use sealed stands, periodic staff checks, and (where the scheme allows) dynamic 12 codes on a screen that is harder to overlay than paper.
Customers should compare the decoded merchant name to the shop fascia. If Tag 59 says a different brand, stop.
Quishing and callback QR
Fraud QR can encode a URL or UPI URI that is not MPM at all. If the decoder does not show Tag 00 = 01, you are not in EMVCo payment grammar. Do not enter PINs or OTPs on a site that opened from an unexpected QR.
Amount and POI surprises
A static QR plus a verbal amount is only as good as the amount the customer types. A dynamic QR with a wrong Tag 54 will charge that wrong amount if the wallet trusts the payload. Cashiers should confirm the on-screen amount before asking the customer to scan.
What operators should log
Log the decoded merchant account template ID and a hash of the payload, not the full PAN-like data if your policy forbids it. After an incident, compare the stored hash to the sticker you still have on the counter.
What this site does
Generation and decode run locally. We do not receive your live merchant credentials. Security still depends on how you print, display, and train staff. EMVCo documents the data objects; it does not operate your store.
Staff script
Once per shift: look at the standee, tug the sticker, compare to a photo of the official code, scan with a staff wallet into a 1-unit test if policy allows. Overlays are usually obvious when someone actually looks.
Customer script
Check merchant name, check amount, check that the app that opened is your bank or wallet — not a browser form asking for a card number. MPM payments stay inside wallets.
Dynamic as a control
Screen QR that expires with the ticket raises the cost of overlay because the attacker’s sticker would not match the current amount. It does not remove the need to check Tag 59.
CRC is integrity, overlay is identity theft of the camera
A valid checksum proves the string was not randomly corrupted. It does not prove the string belongs to the shop the customer is standing in. Overlay stickers and swapped standees encode a different MAI with a perfectly valid CRC. Staff should look at the standee, tug the sticker, compare to a photo of the official code, and optionally run a 1-unit test scan if policy allows. Overlays are usually obvious when someone actually looks.
Customers should check merchant name (Tag 59), amount, and that the app that opened is their bank or wallet — not a browser form harvesting card numbers. MPM payments stay inside wallets. A QR that opens a phishing page is a different object (quishing) than an MPM envelope; do not treat every square as a payment payload.
POI surprises and amount traps
A static 11-code with no amount lets the customer type 18500 instead of 1850. That is not overlay; it is product design. Billed 12-codes reduce that class of loss but require you to retire the old sticker. Dynamic screen QR that expires with the ticket raises overlay cost because an attacker’s stale sticker will not match the current amount — it still does not remove the need to check Tag 59.
Operators should log payload hashes, reprint dates, and terminal IDs. When you change city spelling or MAI, you must reprint and destroy the previous object. Decode in the browser so live proxies are not emailed around. This site does not monitor your counter; we only explain the envelope.
What this site will never claim
We will not claim that generating a QR here makes it “secure.” We will not claim affiliation with EMVCo. Official QR specifications and security-related testing programmes live on emvco.com. Our contribution is local encode/decode, named operator (Pankaj Kalra), and checklists you can actually run at a till.
If you need scheme-grade security requirements (PIN, tokenization, 3-DS, lab approval), those are other EMVCo and scheme programmes — QR is only one technology. Do not paste those PDFs into a sticker operations manual; link them and write your own till script.
Incident response without panic
If overlay is suspected, stop taking scans on that standee, photograph it, decode the string if possible, compare MAI to the stored official payload, and reprint from the known-good string. Do not “quick fix” by editing TLV in a chat app. Notify the acquirer if production proxies were exposed. CRC-valid malicious payloads are still malicious; treat them like a swapped card terminal.
Vendor due diligence
Ask print vendors how they store payload strings, who can change them, and whether they reuse samples across clients. A vendor that emails EMVQRHUB strings to everyone is a supply-chain risk. Prefer vendors who accept your acquirer-issued MAI only.