The Accredited Standards Committee X9 Inc. released X9.150, Merchant-Presented QR Codes for Secure Payment, in 2024. This is the first U.S. standard defining structure, content, and security requirements for merchant-generated payment QR codes. The gap matters: approximately 45 million instant payments happen monthly in the U.S., compared with eight billion in Brazil. That 178:1 ratio reflects more than consumer preference; it reflects fragmentation.
Without a standard, each payment network required its own QR implementation. Merchants supporting multiple networks needed separate integrations. Financial institutions built proprietary schemes. The result was predictable: limited interoperability, friction at checkout, and stunted adoption of account-to-account payments.
Key Findings
The standard separates payment QR codes from URL QR codes at the authentication layer. X9.150 requires that payment QR codes be scanned from within an authenticated mobile app where the user has logged in and the application itself is recognized as an authorized client. This ensures both the payer and the requesting application are trusted before the protected payment payload can be accessed. URL-based QR codes, by contrast, navigate to a web address without app-level authentication. This distinction is crucial for fraud teams, as it removes the attack surface of malicious URLs disguised as payment requests.
One QR code can now initiate payment across different account-based payment methods. Merchants no longer need to support separate payment protocols for each network. The same code works whether the customer pays via their bank app, credit union app, or merchant wallet. From a compliance perspective, this reduces the number of integration points you need to validate and monitor. Fewer integrations mean fewer potential control failures.
The standard defines payload structure and security requirements, not network routing. X9.150 specifies what data goes into the QR code and how it's protected. It doesn't mandate which payment rail the transaction uses. Financial institutions retain flexibility to route transactions through the networks that best serve their customers. Your fraud detection rules and transaction monitoring systems will still operate at the network level, but the front-end presentation layer is now consistent.
Work on X9.150 began in 2024, which means early adoption is happening now. Financial institutions and payment providers are already evaluating implementation. Sarah Hoisington, chair of the X9.150 Work Group, noted that businesses want faster settlement while making it simpler for consumers to pay. The standard creates a foundation for both.
The U.S. had no prior standard for secure merchant-generated QR codes. That absence created the interoperability problem. Now you have a reference framework. Whether you're a bank building a mobile app, a fintech offering payment services, or a merchant evaluating checkout options, X9.150 provides the technical specification you need to ensure your QR implementation works with others.
What This Means for Your Team
If you're managing fraud operations, you need to understand how authenticated app-based QR scanning changes your risk profile. Traditional URL-based QR phishing won't work against X9.150-compliant implementations because the payload is only accessible from within an authenticated app. But you'll still need controls for:
- Account takeover attacks targeting the mobile app itself
- Social engineering that convinces users to authorize legitimate-looking but fraudulent payment requests
- Insider threats where an authenticated user generates malicious QR codes
If you're in compliance, X9.150 gives you a standard to reference when scoping your payment acceptance environment. You can now ask vendors and partners: "Does your QR implementation follow X9.150?" That question didn't have a meaningful answer before. It does now. You'll need to update your third-party risk assessments to include X9.150 compliance checks for any QR-based payment functionality.
If you're implementing payment systems, you need to evaluate whether your current QR approach aligns with X9.150 or requires rework. The standard's requirement for authenticated app scanning may necessitate changes to your mobile app architecture. Plan for that now, before your competitors have interoperable QR payments and you're still running a proprietary scheme.
Action Items by Priority
Immediate: Review your current QR payment implementations against X9.150 requirements. If you're generating or accepting QR codes for payments, compare your current approach to the standard's specifications for structure, content, and security. Identify gaps. Document whether your QR codes require authenticated app scanning or if they're URL-based. If they're URL-based, you're not compliant with X9.150 and you're exposed to phishing attacks that the standard prevents.
Within 30 days: Update third-party vendor questionnaires to include X9.150 compliance. Add specific questions: Does the vendor's QR payment solution follow X9.150? Does it require authenticated app scanning? Can it interoperate with other X9.150-compliant implementations? If you're evaluating new payment vendors, make X9.150 compliance a requirement, not a nice-to-have.
Within 90 days: Assess your fraud detection rules for QR-based transactions. X9.150 changes the threat model. Build detection logic for authenticated-app threats (account takeover, credential stuffing, session hijacking) rather than URL-based phishing. Review your transaction monitoring thresholds for instant payments initiated via QR codes. The standard makes these transactions easier, which means you'll likely see volume increase. Your monitoring system needs to scale with that volume.
Within six months: Plan your implementation roadmap if you're not yet X9.150-compliant. Work with your mobile app development team, payment operations, and compliance to scope the changes needed. Budget for authentication layer upgrades, payload structure changes, and testing with other X9.150-compliant systems. If you're a merchant, engage with your payment processor to understand their X9.150 adoption timeline. If you're a financial institution, coordinate with the payment networks you use to ensure routing compatibility.
