China’s favorite mobile payment technology has a security problem

QR codes are cheap and easy to use, but also vulnerable to scammers

Reading Time:3 minutes

Why you can trust SCMP

A QR code on a rental bike in Shenzhen. (Picture: South China Morning Post)

Karen Chiu

Published: 9:45pm, 25 Jan 2019Updated: 8:51am, 20 Sep 2019

This article originally appeared on ABACUS

Mr. Kwok hadn’t even finished paying for his meal when he received an SMS on his phone, saying that 999 yuan (US$148) was just deducted from his electronic wallet. What’s more, even though he was at a restaurant, the money was sent to a billiard hall, according to Shaanxi Television.

Kwok, a police officer, asked to check the surveillance footage. The culprit turned out to be someone who surreptitiously photographed Kwok’s phone screen, which was showing his personal QR code on Alipay -- Alibaba’s payment app. Using that picture, the offender was able to spend with Kwok’s account.

(Abacus is a unit of the South China Morning Post, which is owned by Alibaba.)

A train passenger scans a QR code to buy a bottle of water. (Picture: Xinhua)

QR codes have spread far and wide as a payment method in China because they are so simple. They don’t require fancy technology to operate: Shoppers either scan the merchant’s code with their phone’s camera, or have the shop scan their personal code with a reader. It’s cheap and easy to use.

How the QR code conquered China

Unfortunately, that also means QR codes can be easily stolen, replaced, or manipulated for nefarious purposes. Among the various risks of mobile payment, scanning QR codes from unknown sources is considered one of the most serious. According to a recent survey by UnionPay, some respondents said they habitually scan every QR code they come across that claims to offer some kind of shopping discount.