EMVCo resets QR code payments

EMVCo recently released new guidelines for Quick Response (QR) code implementation. The specifications update QR technology invented in 1994 by Toyota subsidiary Denso Wave. Two-dimensional QR codes were originally used to track inventory on automobile assembly lines. Denso Wave patented the technology but made it available to other industries, where it has played a pivotal role in numerous use cases, including mobile coupons, smart posters and digital wallets.

In July 2017, EMVCo issued two separate standards for merchants and consumers, designed to standardize QR code functionality within EMV (Europay, Visa and Mastercard) transaction flows. The global body, jointly owned by American Express Co., Discover Financial Services, JCB International Credit Card Co., Mastercard, China UnionPay and Visa, created a high-level solution architecture for QR code payment processing, stipulating how to format, encode, decode and process QR code transactions in compliance with EMV QR Code Payment Specifications.

Consumer-presented QR codes

When consumers select the QR option at the POS, they employ QR credentials on mobile devices linked to their EMV cards. These transactions are authorized online and constitute one-way transfers of data from consumer devices to the POS, which protects embedded payment credentials, according to the specification. EMVCo representatives said the specification covers high-level transaction flows only and does not cover other payments ecosystem components, such as value-added service data in mobile apps and wallet or mobile platform interfaces.

Merchant-presented QR codes

Merchants who offer QR code options to consumers at the POS can use merchant-generated QR codes available in mobile apps. Consumers can use these mobile applications to scan merchant-presented QR codes and initiate payment transactions. Whether the mobile app belongs to a merchant, financial institution or third-party service provider, the payment request will be sent to the EMV card issuer to initiate the funds transfer.

“The Issuer receives the initial payment transaction, and secures or withdraws the transaction amount from the consumer's account,” EMVCo wrote. “Upon receiving the payment transaction, the Acquirer checks the validity of the Merchant Account Information and other merchant credentials and, when valid, credits the payment transaction amount to the account associated with the Merchant Account Information.”

The merchant awaits notification of a successful transaction response before delivering the goods and services to the consumer.

Data object formats

EMVCo additionally requires QR code data to be classified as either allocated by EMVCo, reserved for future use by EMVCo, or unreserved. This organizes the data within each QR code into recognizable categories to attribute “meaning, representation and format as defined by EMVCo in this, and related specifications,” according to the specifications.

It also opens up unreserved fields to third-party service providers, enabling them to assign values to the data objects according to specification rules. EMVCo encourages all third-party providers to use EMVCo-allocated data objects whenever possible to avoid duplicating information or deviating from established conventions, as well as to improve the consumer experience.

Editor's Note:

The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.