“Standards on UnionPay QR Code Payment” was officially issued

“Security Specifications” set forth specific security requirements for QR code reception equipment, mobile client and background system, etc. to ensure the security of account information and funds during payment, and provide security-related standards for the next design and development of QR code products by CUP and banks.

“Application Specifications” define the application scenarios of QR code payment and the security mechanism based on digital signature, set forth QR code application data elements applicable to the financial payment, and provide a reference standard basis for QR code coding scheme in the next design and development of QR code products by CUP and banks.

First, it follows the four-party model of current bank card payment to ensure the security of key elements including cardholder’s account and funds by taking payment security as the base line. UnionPay QR code payment is based on the card organization’s four-party model, its difference from physical bank card payment is only the change in payment information interaction mode, and its background account is still based on the entity bank card account. Just because it is still based on bank card accounts, there is no financial precipitation in the virtual account causing financial risks, and consumer’s funds are more secure. In addition, commercial banks can obtain transparent and complete payment information consistent with traditional bank card payment, facilitating risk identification and control and customer relationship management.

Second, the payment tokenization (Token) technology is used to ensure payment security. UnionPay QR code payment ensures the security of key elements including cardholder’s account and funds by taking payment security as the base line and developing a unified technical security mechanism. The payment tokenization (Token) technology is used to protect the sensitive information of account to ensure the security of account information during storage, processing and transmission and prevent risk of account information disclosure;

Third, the technology model is unified in the same scenarios, which can achieve interconnection. A unified technical program and model is used in the same QR code payment scenarios to achieve business interconnection between different agencies and ensure the consistency of user’s experience;

Fourth, UnionPay QR code payment is compatible with relevant international standards. With technical extensibility, UnionPay QR code payment can be extended to be compatible with relevant international standards in the future to ensure the cross-border interconnection of QR code payment business both at home and abroad in future.

The relevant head of CUP said that CUP would issue the supporting business rules and product solutions in succession subsequently, set up a platform, provide good services, and join with commercial banks and other member institutions to provide cardholders with more low-cost, secure and convenient payment options.

The relevant head of the payment department of the Central Bank said that at the early stage of launch, there were no unified technical standards and testing and certification standards on QR code payment, and no corresponding protection system for consumer’s rights and interests, so all-round promotion may lead to customer’s funds loss and information disclosure risk in a large area. The Central Bank halted QR code payment in March, 2014.

Since then, the Central Bank, on one hand, directed the payment and settlement associations and bank card clearing institutions to study and formulate relevant norms and technical standards, and on the other hand, did not stopped the road of exploring QR code payment. Under the limited support of the Central Bank, the third-party payment agencies such as Alipay launched the “reverse scan”, asking the merchant to use a scanner to scan the QR code generated by consumers, which promotes the development of QR code payment within a certain range.

With the continuous improvement of QR code payment technology and consumer’s awareness of payment security, the regulatory authorities are gradually changing their attitude towards QR code, they not only clear QR code’s payment positioning “as an effective complement of bank card payment”, but also will fully extend it after the establishment of normative system. The Central Bank also said that it would promptly promote QR code payment self-discipline standards up to the financial industry standards when the conditions are ripe.

“银联二维码支付标准”正式发布，移动支付产业加速发展

12月12日从中国银联官网获悉，中国银联正式推出银联二维码支付标准。“银联二维码支付标准”主要包括《中国银联二维码支付安全规范》和《中国银联二维码支付应用规范》两个规范。

《安全规范》从安全方面对二维码受理设备、手机客户端、后台系统等提出了具体安全要求，确保支付过程中账户信息及支付资金的安全性，对下一步银联及银行设计和开发二维码产品提供了安全相关的标准依据。

《应用规范》定义了二维码支付的应用场景和基于数字签名的安全机制，提出了适用于金融支付的二维码应用数据元，对下一步银联及银行设计和开发二维码产品中的二维码编码方案提供了可参照的标准依据。

银联二维码支付主要有以下四方面特色：

首先，遵循现有银行卡支付的四方模式，以支付安全为底线，确保持卡人账户、资金等关键要素的安全。银联二维码支付基于卡组织的四方模式，与实体银行卡支付的差异仅在于支付信息交互方式的变化，其后台账户仍基于实体银行卡账户。正因为仍旧基于银行卡账户，不存在因资金沉淀在虚拟账户带来金融风险，消费者资金安全更有保障。此外，商业银行可以获取与传统银行卡支付一致的、透明的、完整的支付信息，有利于风险识别管控和客户关系管理；

其次，采用支付标记化(Token)技术，确保支付安全。银联二维码支付以支付安全为底线，通过制定统一的技术安全机制，确保持卡人账户、资金等关键要素的安全性。采用支付标记化(Token)技术对账户敏感信息进行保护，确保账户信息在存储、处理和传输过程中的安全性，防止发生账户信息泄露的风险；

第三，相同场景下技术模式统一，可以互联互通。在相同的二维码支付场景采用统一的技术方案和模式，实现不同机构之间的业务互联互通，确保用户使用体验的一致性；

第四、兼容相关国际标准。预留技术扩展性，未来可通过扩展实现对二维码支付相关国际标准的兼容，确保今后境内和境外二维码支付业务的跨境互联互通。

中国银联相关负责人表示，后续还将陆续发布配套的业务规则和产品方案等，搭好平台，做好服务，联合商业银行以及其他成员机构，共同为持卡人提供更多低成本、安全、便捷的支付选择。

央行支付司相关负责人表示，在推出初期，二维码支付没有统一的技术标准和检测认证标准，更没有相应的消费者权益保护制度，如果全面推广可能会引发大面积客户资金损失和信息泄露风险。2014年3月央行叫停了二维码支付。

此后，央行一方面指导支付清算协会和银行卡清算机构研究制定相关规范和技术标准，另一方面也未堵住扫码支付探索之路。在央行有限度地支持下，支付宝等第三方支付机构推出“反扫”，让商户用扫码器扫消费者生成的二维码，一定范围内推进二维码支付发展。

随着条码支付技术、消费者支付安全意识不断提升，监管部门对于二维码的态度逐步转变，不仅明确其“作为银行卡支付有效补充”的支付定位，还将在规范制度确立后全面推开。央行还表示，待条件成熟后，将适时推动二维码支付自律性标准上升为金融行业标准。