QR Code
PCIComplianceHubLast updated
A two-dimensional barcode that can be scanned and read by smartphones or other devices equipped with a QR code reader. QR codes can be used in payment processing and other applications, but organizations using QR codes should ensure that they are used securely and in compliance with PCI DSS requirements.
Applies to. No PCI DSS v4.0.1 requirement names QR codes, and scanning one does not by itself move account data. In payments a QR code is usually a link: the customer scans it and pays in a wallet app or on a web page run by a gateway or their bank, so from the merchant's side the transaction is card-not-present and the merchant's scope depends on where that page lives and what its systems receive, the same SAQ A, SAQ A-EP or SAQ D question as any e-commerce checkout. A printed code on a table card or invoice can be swapped for one that points elsewhere, which is a fraud risk for the merchant's own checks and its acquirer's rules rather than PCI DSS; in the rare case where the code carries the PAN itself, the scanner and the system it feeds handle account data and are in scope.