Payment QR Code: How to Create and Accept QR Payments in 2026
Brazilians scanned roughly 7.87 billion payment QR codes in December 2025 alone — a single country, a single month, more transactions than Visa and Mastercard combined in that window in Brazil. India's UPI cleared 21.63 billion QR scans the same month. Global QR payment value hit about $5.4 trillion in 2025 and Juniper Research projects $8 trillion by 2029. Whatever else the payment QR code is, it is no longer the black-and-white square taped above a coffee shop counter. It is one of the dominant payment rails on the planet, and learning how to issue one is now a basic operational skill for any business selling across borders.
This guide explains what a payment QR code actually encodes, how the spec layer works, which formats matter in 2026, how to generate one (with a step-by-step using Plisio for crypto payments), the live market, the security risks behind quishing, and the questions to ask before picking a provider.
What a payment QR code is and what it encodes
A payment QR code is a 2D matrix barcode encoding payment information a wallet or banking app can parse and execute. ISO/IEC 18004:2024 is the current edition of the QR standard (formally a "quick response code"). The code itself holds no money. It is just a short URI string a payment app recognizes. The URI might be a bank account identifier, an instant-payment scheme tag, or a crypto address with the amount baked in.
A bit of history. Masahiro Hara invented QR in 1994 at Denso Wave, a Toyota subsidiary, for tracking car parts on the assembly line. Denso Wave decided not to enforce the patent. That single decision is why QR codes now sit on coffee shops, checkout pages, and parking meters alike. Alipay began using QR for offline retail in China in 2011; consumers there now simply scan the QR code to pay rather than carry cards.
How a payment QR code actually works
Every payment QR code shares the same physical anatomy. Three large corner squares act as position markers. Smaller alignment markers help when the camera is at an angle. The codes use Reed–Solomon error correction at one of four levels: L (~7% recovery), M (~15%), Q (~25%), H (~30%). That is why a partially smudged sticker still scans. Versions run from 1 (21×21 modules) up to 40 (177×177 modules, up to 7,089 numeric characters). A payment URI rarely needs more than 300.
The payload is what matters in payments. Five formats are worth knowing in 2026.
Start with EMVCo Merchant-Presented Mode (MPM, v1.1). It is the TLV-encoded format underneath most national QR rails — PIX in Brazil, PromptPay in Thailand, DuitNow in Malaysia, PayNow in Singapore, BharatQR in India, HKQR in Hong Kong. EMVCo also defined a Consumer-Presented Mode, where the customer's wallet shows the code and the merchant scans it.
BIP21 is the Bitcoin URI scheme: `bitcoin:
?amount=&label=`. It has been formally superseded by BIP321, but BIP21 remains the dominant on-the-wire format in 2026.
EIP-681 does the same job for Ethereum: `ethereum:0xabc...?value=2.5e18` for native ETH, with a richer form for ERC-20 tokens like USDC and USDT. The standard also allows arbitrary contract calls, not just transfers.
Solana Pay is the spec used by Solana wallets and merchants: `solana:?amount=&spl-token=&reference=&memo=`. The reference field is a public key the merchant uses as a correlation ID. The merchant polls `getSignaturesForAddress` to detect the payment before it ever sees the transaction signature. Sub-second finality, fees fractions of a cent.
LNURL-pay is what makes Bitcoin Lightning practical for retail. A raw Lightning invoice is long, single-use and amount-locked. LNURL-pay encodes a bech32 URL pointing to a server endpoint; the wallet hits the endpoint, retrieves a Lightning invoice, and pays. BTCPay Server, Blink, Breez and LNURLPoS all use this pattern.
The wallet does the work end to end: read the URI, populate the form, sign with the user's key or PIN, and broadcast the payment. The payment process is shorter than tapping a card, which is why customers in QR-heavy markets simply scan QR codes instead of carrying one.
Static vs dynamic QR codes for payments
Two flavors. Static QR codes carry one fixed payload (a wallet address, a merchant ID) and ask the customer to type the amount manually. Dynamic QR codes are minted per transaction. Amount baked in, invoice ID attached, short time-to-live. Both forms are how QR codes work in practice, but only dynamic codes give a revocable payment link. Most businesses get the default backward. Dynamic is the right call in nearly every commercial setting. Static belongs only where the security trade-off has been thought through and accepted.
| Type | Content | Best for | Security |
|---|---|---|---|
| Static | Fixed payload (wallet address, merchant ID); customer enters amount | Tip jars, donation buttons, low-volume kiosks | Lower — same code can be photographed and replayed; sticker overlays target static codes |
| Dynamic | Generated per transaction, includes amount and invoice ID, often time-limited | E-commerce checkout, POS terminals, invoices | Higher — single-use, revocable, harder to spoof |
The other piece is analytics. Dynamic codes route through a server, which means the merchant gets scan logs, geolocation hints, and conversion data. Static codes give you nothing.
How to create a payment QR code with Plisio
Plisio is a non-custodial crypto payment gateway, and it is the easiest concrete example for walking through the steps. Funds route straight to the merchant's wallet, and Plisio never holds them. The fee is 0.5% flat on the Gateway API tier, 1.5% on the White Label tier, and free on the personal Wallet tier. There is no KYC on the standard tier. Coins supported include BTC, ETH, USDT, USDC, LTC, BCH, DOGE, DASH, XMR, ZEC, TUSD, BTT, TRX, BNB, BUSD and ETC. Multi-chain USDT (TRC-20 and ERC-20) coverage is standard.
There are four routes to a Plisio payment QR code, and a merchant will pick by integration depth.
Option A is the dashboard. Sign up at plisio.net with email and password. Open the dashboard, go to Invoices, click New Invoice. Enter the amount in USD or EUR, pick the cryptocurrencies you want to accept payments in, and click Create. Plisio returns an invoice URL with an embedded dynamic QR. A customer can scan a QR code with any wallet app to pay. Print it, paste it into an email, or display it at the counter.
Option B is the REST API. Endpoint base is `https://api.plisio.net/api/v1/`. Calls are HTTP GET, responses are JSON. The invoice-creation endpoint can generate QR codes on demand and returns a hosted page containing the dynamic QR plus a raw `wallet_hash` you can use to render your own UI. Webhooks fire status updates (`new`, `pending`, `completed`) so the order pipeline updates automatically.
Option C is the white-label POS. A merchant who does not want Plisio branding picks the White Label tier (1.5% fee instead of 0.5%). The payment page renders with the merchant's own brand, the QR is generated server-side per order, and the customer never sees a Plisio logo. Cafes, kiosks and in-store terminals tend to land here.
Option D is a plugin install. Plugins exist for WooCommerce, Magento, PrestaShop, OpenCart, BigCommerce, Ecwid and Shopware, with donation widgets for Twitch, YouTube, TikTok, Twitter, Instagram and Facebook. Install, paste the API key, set accepted coins, and the checkout grows a "Pay with Crypto" option that renders a QR.
What the customer sees is the same regardless of route: a QR code, a countdown timer for the locked exchange rate, and a confirmation screen once the payment hits its first block confirmation. The merchant gets the funds at their wallet address; Plisio takes its 0.5% before settlement.
The 2026 QR payment market: PIX, UPI, and crypto rails
Three rails carry most of the 2026 volume. Brazil. India. China. Anyone planning a QR strategy needs a working picture of all three.
Brazil's PIX cleared roughly 7.87 billion transactions in December 2025. One month. One country. Full-year 2025 ran to about $6.7 trillion, up 34% YoY (EBANX, CEIC). PIX overtook combined card volume in Brazil in Q1 2023 (PCMI counted 8.1B PIX against 8.0B credit-plus-debit).
India's UPI is on an even steeper arc. The CY2025 totals come in at 228.3 billion transactions and ₹299.7 lakh crore (about $3.5 trillion), with 21.63 billion in December 2025 alone. UPI now handles roughly half of every real-time payment in the world.
China is bigger, just harder to count precisely. Alipay and WeChat Pay between them carry more than 90% of the country's mobile payments, and over 90% of those payments fire via QR scan. Alipay alone reported 726 million MAU in February 2026.
Crypto QR is the newer entrant on this list. Visa's USDC-on-Solana settlement pilot hit a $3.5 billion annualized run rate by November 2025, and 2026 brings expansion to Cross River Bank and Lead Bank. Juniper Research puts global QR payment value at $5.4 trillion in 2025 and projects $8 trillion by 2029 across 61 countries. The methodology is generous: QR is treated as one accounting category despite the underlying rails being radically different. The growth is still real.
| Rail | Issuer | Fee to merchant | Speed | Finality | Geography |
|---|---|---|---|---|---|
| PIX | Banco Central do Brasil | 0 to ~0.2% | <10 s | Bank-reversible (fraud cases) | Brazil |
| UPI | NPCI | ~0% (P2M MDR capped) | <5 s | Reversible | India |
| Visa / Mastercard QR | Visa / MC | 1.5–2.5% | <30 s | Chargeback up to 180 days | Global |
| WeChat Pay / Alipay | Tencent / Ant | ~0.6% | <5 s | Platform-reversible | China |
| Plisio (crypto) | Plisio (non-custodial) | 0.5% | 1 confirmation (~10 min BTC, ~30 s TRX) | Irreversible | Global |
| Solana Pay | Solana ecosystem | ~$0.0001 network fee | <1 s | Irreversible | Global |
| Lightning / LNURL | Lightning Network | <0.1% | <1 s | Irreversible | Global |
Where businesses use payment QR codes
Six concrete deployment patterns are visible in 2026.
Retail POS is the largest: PIX QR stickers on the counters of Brazilian padarias, UPI QR tags pinned next to phone shops in Mumbai, Lightning QR codes in cafes across El Salvador and Lugano. Restaurants use static QR codes for menu and bill payment combined into one scan. E-commerce checkout flows render a dynamic QR per cart through Shopify or WooCommerce plugins, eliminating the card form for mobile-first customers. Cross-border invoicing is one of the strongest crypto QR use cases: a SaaS supplier in Tallinn emails an invoice URL to a customer in Lagos, the customer scans, pays in USDT-TRC20, and the supplier sees funds in minutes for 0.5%. Donations are easy: a non-profit pastes a static BIP21 QR on a flyer, a content creator drops a Plisio widget under their Twitch stream. Peer-to-peer transfers use UPI handle QRs in India and Pix Key QRs (CPF, phone, email) in Brazil for splitting restaurant bills.
Security and quishing: what merchants need to know
The biggest single threat is not technical. It is a scammer printing a sticker with a phishing URL inside the QR and pasting it over the legitimate one. Redondo Beach police found roughly 150 fake QR stickers on the city's parking meters in 2024, and the pattern was repeated across Austin, Atlanta, San Antonio, and several Los Angeles-area beach cities. Restaurants, EV chargers, and hotel-room TV menus have all reported the same vector.
QR phishing has scaled fast on the digital side too. Keepnet's 2026 update found that about 12% of all phishing emails carried a QR code in 2025. The volume of quishing emails jumped from roughly 47,000 in August 2025 to 249,000 by November. A fivefold surge in three months. Roughly 90% of those attacks aimed at credential theft. Executives were about 40 times more likely to be targeted than rank-and-file staff. Only about 36% of QR phishing attempts got caught by users or filters. The FBI's IC3 issued a 2026 FLASH alert covering North Korea's Kimsuky group, which had been embedding malicious QRs in spearphishing emails. Reported phishing complaints to IC3 hit 300,487 in 2024, about ten times the 2018 figure.
The defenses are simple and underused. Use dynamic QR codes for any commercial payment so the code can be revoked. Verify the URL preview before tapping confirm — every reputable wallet shows the destination. Stay on HTTPS, avoid chained redirects, and sign the payload with the EMVCo MPM MAC field where it applies. For crypto the address-plus-amount in the URI blocks wrong-amount errors. The remaining live risk is chain mismatch: a customer scanning a USDC URI and sending USDC on the wrong chain. Wallets like Trust Wallet and MetaMask warn on this now, but a merchant should still avoid mixing chain identifiers in one QR.
Benefits of payment QR codes for merchants
The benefits of QR code payments survive scrutiny on four axes. Cost: no specialized hardware required, just a printer or a screen, which is why margins-thin businesses adopt contactless payment via QR before they ever consider a card terminal. Speed: PIX and UPI settle in under five seconds, and a digital payment via QR code typically clears faster than tapping a card. Geography: QR works anywhere a smartphone reaches an internet connection, which now covers more of the world than card-acquirer networks do. Optionality: a single QR can route to PIX, UPI, a Visa-network QR, or a stablecoin URI, supporting multiple payment methods through one code, depending on what the customer's wallet supports. Secure payment flows benefit from biometric confirmation built into the wallet.
Choosing a QR payment solution
Six questions. Ask them in order before picking a QR code solution.
One: which rail do your customers actually use? PIX, UPI, Visa QR, Alipay, crypto. Two: static or dynamic, and is the security trade-off conscious if you pick static? Three: what is the total fee, including network, processor, and FX, not just the headline percent? Four: settlement currency. Fiat to bank, stablecoin to wallet, mixed? Five: refund handling on an irreversible rail. Does the payment solution do it for you, or does it sit on your books? Six: integrations. Shopify, WooCommerce, Magento, REST API, plugin marketplace.
What I keep coming back to is that there is no universal answer. For crypto QR codes the live options in 2026 are Plisio (0.5%, non-custodial, no KYC standard tier), BitPay (1%, KYC-heavy), CoinGate (1%, fiat settlement option), NOWPayments (0.5% with custodial option), BTCPay Server (free, self-hosted, technical to operate), and OpenNode (Bitcoin/Lightning specialist). For fiat instant rails the choice is country-specific. PIX intermediaries in Brazil. NPCI-licensed apps in India. Big-tech wallets in China. The right combination depends on which two of those six questions weigh most for your business.
