CoDi in Mexico: how QR payment requests work and what to watch

With CoDi, Banco de México's digital payment request platform, the merchant generates a payment request (as a QR code, over NFC or sent to the customer's phone) and the payer accepts it in their banking app, which triggers an instant transfer. Because the payer approves every operation and CoDi has no chargebacks, online sellers must make sure the QR code and details shown on the page are exactly what they issued: a tampered request is paid instantly, to the wrong account.

How a CoDi payment request works

CoDi was developed by Banco de México (Banxico) and began operating on September 30, 2019. It runs on SPEI, Mexico's interbank payment system, 24 hours a day, every day, and Banxico states that operations carry no additional fees. When payer and payee bank with different institutions, the transfer goes through SPEI; when they use the same bank, it becomes an internal transfer.

According to Banxico's official guides, a payment request has four steps:

1. The merchant generates a CoDi request with the sale details (amount and payment description) through its bank's app, a third-party app or Banxico's own CoDi app.
2. The request reaches the customer: through a QR code, which can be fixed at the point of sale or generated per transaction; over NFC, by bringing the phones together; or, for remote sales, as a notification on the phone.
3. The customer reviews the request in the banking app (including the payee's name, the amount and the description) and authorizes it with a PIN, fingerprint, face recognition or token.
4. Both sides receive a notification confirming the money is already available in the seller's account.

For merchants, the benefits are clear: funds arrive in seconds and, because the buyer expressly accepts every operation, Banxico highlights that there are no chargebacks.

Where online merchants are exposed

CoDi's security lies in the infrastructure and in the payer's authorization. The weak point comes earlier: the screen where the request is presented. In an online store, the CoDi QR code is shown on a page that loads plugins, third-party scripts and integrations. If one of those components is compromised, it can swap the legitimate QR code for another one generated for a criminal's account, with the same amount and a plausible description.

The customer scans, sees an amount that matches the cart and authorizes. Step 3 (checking the payee's name) is the only barrier, and it depends on the customer noticing a different name at a moment when all they want is to finish the purchase. Once authorized, the transfer is immediate, and the same feature that protects the merchant from chargebacks leaves the customer with no simple way to recover the money. For the store, the result is a paid order that never reached its account and a customer convinced the store was at fault.

Confirm with your bank, not with the customer

Since both sides receive the bank's confirmation, the rule for releasing orders is simple: only treat as paid what shows up as a credit in your account or in your institution's notification. Receipts sent by the customer, screenshots or “I already paid” messages do not replace that check, and a rise in “paid” orders that never show up in your statement is a warning sign that something may be swapping the request along the way.

What about DiMo?

Banxico also offers DiMo (Dinero Móvil), which lets people receive transfers using only the mobile number linked to their account. The link is set up in the banking app with the account holder's consent, and each number is tied to a single account per institution. For online sellers the same care applies: if the page shows a mobile number for payment, that detail must be exactly yours too.

Checklist for accepting CoDi in e-commerce

• Generate one request per order, with a fixed amount and a description that identifies the purchase, instead of one static QR code for everyone.
• Show the payee name the customer will see in the app, so they can compare before authorizing.
• Tell customers to check name, amount and description in the banking app before confirming.
• Release orders only on your institution's confirmation, never on screenshots.
• Cut third-party scripts on the payment page and keep your platform and plugins up to date.
• Verify, in the customer's browser, that the QR code and details shown are the ones you issued, and block any mismatch before it is scanned.

How Proteside protects the CoDi request

Proteside runs on your payment page and checks, in the buyer's browser, that the CoDi QR code, payee and amount displayed are exactly what your store issued, blocking any swap before the customer authorizes in the app. See CoDi payment protection and try it free for 14 days.