China’s central bank tightens security in US$5.5 trillion QR code payment services
From April, high-value transactions will be subject to multi-level verification, as service providers told to better protect users
China’s mobile payment services will be subject to tighter security from next year as the central bank seeks to maintain control in the rapidly expanding hi-tech sector.
Under new rules released by the People’s Bank of China on Wednesday, all transactions over 500 yuan (US$76) will be subject to additional levels of verification. As the transaction value passes each trigger point – 1,000 yuan, 5,000 yuan and unlimited – so the security checks will increase.
While the document did not stipulate the exact methods payment service providers should use to verify a consumer’s identity, they are likely to be the usual combination of passcodes, electronic signatures and fingerprints.
In just a few years, QR-code payment systems have become ubiquitous on China’s mainland, with consumers using them to pay for everything from a bag of rice to a new car. According to internet consulting firm iResearch, US$5.5 trillion worth of transactions – about half the country’s GDP – were conducted via mobile devices in 2016.
As well as the changes to the verification requirements, the new rules, which come into force on April 1, stipulate that all companies providing bar code-based payment services must obtain both an online payment licence and a bank card receipt business licence, and that all cross-bank transactions involving bar codes must be channelled through the PBOC’s or other approved clearing system.
In a statement released on Wednesday, the central bank acknowledged the huge popularity and rapid proliferation of mobile payment systems, but said the technology could not be allowed to grow without controls.
“Ease of use and good user experiences are the lifelines of payment innovation, but it cannot carry on without any bottom lines,” it said.
Mobile transactions were susceptible to cybercrime, it said, adding that the new rules would make it harder for criminals to profit from stolen consumer data.
The regulations also seek to prevent unfair competition in the sector, where some companies have abused their positions to prevent the entry of competitors, the statement said.
China’s mobile payment market is dominated in a near duopoly by Alibaba, which owns the South China Morning Post, and Tencent. They have a combined market share of about 90 per cent.
Alipay, the payment arm of Alibaba, said in a statement that it was studying the new rules and “recognises the efforts made by the central bank in regulating bar code payment and mobile payment”.
Similarly, Tencent’s payment unit said it was familiarising itself with the new rules and “recognised the central bank’s efforts in regulating bar code payment”.
The PBOC has been steadily working to align the mobile services offered by Alibaba and Tencent to the conventional banking system and payment infrastructure.
In 2011, it approved QR payment services at non-banking institutions, though some services were suspended temporarily in 2014 over security concerns.
Despite the lack of state regulation, the spread of QR code payment systems in China – a market 50 times its US equivalent by value – is unlikely to end any time soon.
