Dec. 28 (NBD) -- The People's Bank of China (PBOC) released the "QR code payment regulation" (hereinafter referred to as "the regulation") Wednesday to contain risks arising from the popular service.

It is the first time that the central bank has issued such a regulation, which stipulates that individual customer can only pay 500 yuan (76.4 U.S. dollars) at most via personal QR code each day.

Zhao Yao, researcher of the Research Center for Payment and Settlement under the Chinese Academy of Social Sciences, told NBD that static QR codes are vulnerable to Trojan viruses if they are repeatedly used. As a result, customers might lose their money. 

Compared to credit card payment, barcode payment is easy to use, which offers better user experience. However, it's more likely to be attacked by hackers. In addition, printed barcodes are easily to be changed by violators. 

Statistics show that QR code payment is mainly applied in daily micropayments. The rule is reasonable because deals completed via QR codes and worth less than 500 yuan (76.4 U.S. dollars) constitute 95 percent of daily barcode payments, he explained. 

The regulation also stipulates that for deals requiring two or more means of verification (digital certificate or digital signature included), the amount of payment could be negotiated between customers and merchants. For those requiring at least two or more means of verification (digital certificate and digital signature both excluded), individual customer can pay no more than 5,000 yuan (764.4 U.S. dollars) with single or all of his/her bank accounts in a single day. For those requiring less than two methods of verification, the maximum payment limit of individual customer is 1000 yuan (152.9 U.S. dollars) daily. 

Payment institutions must obtain proper permits to offer barcode payment services, according to a document released by the PBOC. Meanwhile, the regulation says that the money collected via credit card-based QR code payment by a small or micro business under the same ID card or the same acquirer's system should not top 1,000 yuan (152.9 U.S. dollars) a day and 10,000 yuan (1,528.8 U.S. dollars) a month from a single user, so as to prevent cash-out and other transaction risks. But there is no limit to the amount of money collected via deposit card-based QR code payment.   

In addition, both banks and payment institutions must channel cross-bank transactions involving barcodes through the clearing system of the PBOC or other legal clearing houses.

QR code has greatly facilitated retail payments, but the market is not well regulated. Since 2014, financial institutions have been competing against each other by subsidizing users to promote their QR code payment services. The regulation helps usher in the era of standardized QR code payment, Zhao added.

Email: tanyuhan@nbd.com.cn