QR Code Payments for Small Business: How They Work

How a QR payment actually works

A QR code is just a link that a phone camera can read. In a QR payment, that link opens a payment page or app where the customer confirms the amount and pays with a card, Apple Pay or Google Pay. Behind the scenes a payment processor such as Stripe handles the card, and the money is paid out to your business account the same way a terminal payment would be.

There are two kinds of code. A dynamic code is generated for one specific sale: you enter the amount on your screen, a code appears with that amount baked in, the customer scans it and pays exactly that. The code expires after a short time so it cannot be reused. A static code is printed once and stuck to the counter or a market table; the customer scans it and types the amount themselves. Dynamic codes suit a staffed counter; static codes suit places where there is no screen to show, such as a stall or a delivery bag.

What you need to get started

The short answer is less than you think. You do not need a card reader, a terminal or a merchant account from your bank. You need a payment platform that supports QR payments, a completed onboarding with its payment processor so money can be paid out to you, and a device to show dynamic codes on - a tablet, phone or the computer you already have at the counter. For static codes, you need a printer.

With Sopoints Scan & Pay, the merchant completes Stripe onboarding, has the feature on their plan, and can then show a dynamic code from the same POS screen staff use for loyalty, or print a static one. Customers pay in the Sopoints app with a card, Apple Pay or Google Pay, and payouts go to the merchant’s own Stripe account. Other platforms have similar setups; the main things to confirm are who the processor is, where the money lands and how long payouts take.

Is it secure?

A well-built QR payment is as secure as a card payment, and in some respects simpler to reason about. The card details are handled by the payment processor inside the customer’s own app or wallet, never typed into a web page you control and never seen by your staff. That keeps card data away from your business entirely, which is why platforms built this way sit in the lightest PCI-DSS category.

Two design details matter. Dynamic codes should be short-lived and tied to one amount, so a code photographed by someone else is useless a minute later. And a code should stop working the moment a merchant account is suspended, so a sticker left on a wall cannot keep collecting money for a business that no longer exists. Ask any provider how long their codes live and what happens to a printed code if the account is closed. Sopoints codes expire quickly, card details are never entered on the web, and a suspended merchant’s code stops taking money.

Where QR payments shine

Where a card terminal still wins

A terminal is faster for customers who do not want to open an app, and there are still plenty of them. Tap-to-pay with a physical card is a habit; scanning a code, opening an app and confirming an amount is a small new behaviour that some people will resist, especially in a hurry. If your customers are mostly one-time visitors who will never come back, the loyalty benefit of QR is worth less and the friction is worth more.

A terminal also handles some situations QR does not: a customer whose phone is dead, a corporate card that only works by chip, and a business where staff cannot see the customer’s screen to confirm payment. The honest recommendation for most small businesses is to add QR alongside a terminal rather than instead of one, at least at first, and let customers choose. If nearly everyone picks QR after a few months, you can decide then whether the terminal is still earning its rent.

Refunds and disputes in plain words

Refunds on a QR payment work like refunds on any card payment: you issue them from your dashboard, in full or in part, and the money goes back to the card the customer paid with. If the sale earned loyalty points, a good platform claws back the matching points at the same time so the customer is not left with a reward for a purchase they returned. With Sopoints, refunds are issued from the merchant dashboard and points are reversed in proportion.

Chargebacks exist with any card payment, QR included. A customer can dispute a charge with their bank, and the payment processor will ask you for evidence. QR payments have one small advantage here: the customer actively scanned, confirmed the amount and paid from their own device, which is useful evidence. Keep receipts, keep your descriptions clear, and make sure your business name appears on the cardholder’s statement so nobody disputes a charge they simply did not recognise.

The loyalty angle: every payment is a known visit

The quiet advantage of QR payments for a small business is that paying and identifying happen in one motion. With a terminal, a customer pays anonymously unless someone remembers to ask for their phone number, and on a busy shift nobody does. With a QR payment made through a loyalty app, the customer is known the instant they pay, and the points, the visit count and the analytics all update from that one action.

That turns your payment history into a customer list you can actually use: repeat rates, lapsed customers, birthday offers and win-back messages, all without a separate enrolment step. If loyalty is part of why you are considering QR, look for a platform where payment and points are the same transaction rather than two systems bolted together. You can read more about how Sopoints does this at /qr-code-payment and /scan-pay.

How to introduce it at the counter