QR payment standards compared: UPI, PIX, EPC, EMVCo

UPI uses its own upi:// deep link; PIX, PromptPay, QRIS, DuitNow and PayNow are all EMVCo tag-length-value profiles; EPC uses a twelve-line text block. They are structurally different and none are interchangeable, though all are merchant-presented.

The three families

Family	Format	Used by
Deep link	`upi://pay?...`	India (UPI)
EMVCo TLV	`00020126...6304ABCD`	Brazil (PIX), Thailand (PromptPay), Indonesia (QRIS), Malaysia (DuitNow), Singapore (PayNow/SGQR), India (BharatQR)
Line-based text	`BCD\n002\n...`	Eurozone (EPC/GiroCode)

Side by side

	UPI	PIX	EPC	PayPal
Region	India	Brazil	Eurozone	Global
Format	URI deep link	EMVCo TLV	12-line text	HTTPS URL
Checksum	none	CRC16	none	none
Identifier	VPA (`name@bank`)	PIX key	IBAN	PayPal.Me handle
Settlement	Instant	Instant	1 business day (or instant SEPA)	Varies
Cost to receive	Free P2P	Free	Free (bank transfer)	1.4–3%
Text fallback	The URI	copia e cola	The IBAN	The URL

What they have in common

All are merchant-presented: the payee displays a code, the payer scans it, and the payer confirms. None can pull money without the payer's explicit authorisation and authentication.

All suffer the same dominant real-world fraud: a sticker pasted over the genuine code. And all share the same defence: print the payee name large, so the customer notices when the confirmation screen says something else.

All benefit from the same fallback: print the payment identifier as text. copia e cola for PIX, the VPA for UPI, the IBAN for EPC. When a camera struggles, the payment still completes.

Consumer-presented codes

EMVCo also defines a consumer-presented mode, where the customer's app shows a rotating code that the merchant scans. Used at supermarket tills in several markets. Those codes are deliberately short-lived and must never be printed or shared.

Choosing

Use the local rail where one exists. UPI, PIX and SEPA are free or near-free; a card processor is not. For a domestic merchant the difference is the whole margin on a small transaction.

Use a global processor only when you genuinely need cross-border acceptance or buyer protection.

FAQ

Are UPI and PIX QR codes compatible?

No. UPI uses a upi:// deep-link URI; PIX uses an EMVCo tag-length-value string with a CRC16 checksum. A PIX app cannot read a UPI code or vice versa.

Which QR payment standards use EMVCo?

PIX in Brazil, PromptPay in Thailand, QRIS in Indonesia, DuitNow in Malaysia, PayNow and SGQR in Singapore, and BharatQR in India. Each adds its own nested template ids.

Can someone take money from me by making me scan a code?

No. All merchant-presented payment codes initiate a payment from the scanner and require explicit confirmation and authentication. Any "scan to receive money" message is a scam.

What is the most common payment QR fraud?

A physical sticker pasted over a genuine code. The defence is to print the payee name large enough that customers notice a mismatch on their confirmation screen.