How QR Codes Actually Work, and Why India Scans the Most

Walk into almost any shop in India today, from a five-star restaurant to a roadside chai stall, and you'll see the same small black-and-white square taped to the counter. Nobody hands over cash, nobody swipes a card. You just point your phone at the square, tap a few times, and you're done. That square has quietly become one of the most-used pieces of technology in the country, and most people who scan it a dozen times a day have no idea how it actually works.

It's Just a Very Clever Barcode

A QR code (short for Quick Response code) is a type of matrix barcode — a grid of black and white squares that stores information in two dimensions instead of the single row of lines you'd see on a product barcode at a supermarket. That second dimension is what makes it so powerful: a regular barcode can hold a few dozen characters, but a QR code can pack in thousands, enough for a full web address, a chunk of contact details, or the exact bank and account information needed to complete a payment.

Your phone's camera reads the pattern the same way your eye reads a word — except instead of letters, it's decoding squares. Three larger squares sit in three corners of the code; these are called finder patterns, and their only job is to tell the scanning app which way is up, so the code can be read correctly even if your phone is tilted, upside down, or scanning from an angle.

A barcode tells a cash register what something is. A QR code tells your phone what to do next.

Why It Still Works With a Scratch or a Coffee Stain On It

Here's the part that surprises most people: you can tear a corner off a QR code, spill tea on part of it, or print it slightly blurry, and it will often still scan just fine. That's thanks to something called error correction, a bit of built-in redundancy that lets the code rebuild missing or damaged data, similar in spirit to how a cricket scoreboard can still make sense even if you missed a few overs — the pattern of the game fills in the gaps. Depending on how the code was generated, up to roughly 30% of it can be damaged or obscured and it will still scan correctly.

• Encoding: the QR generator converts text, a link, or payment details into the black-and-white grid pattern.
• Scanning: your phone's camera photographs the grid and locates the finder squares to orient itself.
• Decoding: software translates the pattern back into the original data — a URL, a Wi-Fi password, or a merchant's UPI ID.
• Action: your phone opens that data in the relevant app, whether that's a browser or a payments app.

The Reason India Runs On These Things

No country scans QR codes for payments the way India does, and that's not an accident — it's the direct result of how UPI (Unified Payments Interface, the real-time payment system that lets any bank account talk to any other) was designed. Rather than every bank or wallet company printing its own incompatible QR code at a shop counter, the National Payments Corporation of India (NPCI) pushed for a single interoperable QR standard. Scan the same sticker with any UPI app — PhonePe, Google Pay, Paytm, your bank's own app — and the payment goes through the same way. That single decision is arguably what let a roadside vendor accept digital payments as easily as a mall showroom, without needing a card machine that costs money to rent and maintain.

It's also why the humble QR sticker keeps evolving rather than disappearing. NPCI has been steadily extending what sits behind that square — from letting it carry richer merchant data to laying groundwork described in its Unified Agent Protocol, which is designed to eventually let software agents initiate UPI payments on a person's behalf. The square on the counter looks the same; what's plumbed in behind it keeps getting more capable.

Where It Goes Wrong: Quishing Scams

The same flexibility that makes QR codes useful also makes them an easy target for a scam now nicknamed "quishing" — phishing via QR code. Because a human eye can't tell what a QR code will actually do just by looking at it, a scammer can paste a fake sticker over a genuine one at a parking meter or shop counter, and it will happily send your payment to their account instead. A few habits keep this from becoming a problem:

1. Check the payee name your app shows before confirming any payment — never confirm on autopilot.
2. Be suspicious of a QR code that looks like a sticker pasted over another sticker.
3. Never scan a QR code you received to "claim a refund" or "unlock a prize" — legitimate refunds don't need you to scan and pay anything.
4. For payment QR codes specifically, remember that receiving money never requires entering your UPI PIN — if a scan prompts you for a PIN to "receive" a payment, stop immediately.

A Genuinely Useful Bit of Tech

QR codes aren't glamorous, and the technology behind them is decades old — they were actually invented in Japan in 1994 to track car parts on a factory floor, long before anyone imagined they'd end up on a chai stall's counter. What changed is the infrastructure around them: cheap smartphone cameras, decent mobile data, and in India's case, a payment network deliberately built to make that little black-and-white square do something genuinely useful for a billion people. The next time you scan one, it's worth remembering there's real engineering packed into that square — and that a two-second glance at the name on your screen before you confirm a payment is still the best protection you have.