Skip to content

Transferencias 3.0: Argentina's interoperable QR and tampering

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

Under Transferencias 3.0, any wallet reads any QR code and payments are immediate and irrevocable, so a tampered QR code at checkout is paid by any app. Merchants should use dynamic QR codes, release orders only on confirmed credit and verify that the code displayed is the one they issued.

Under Transferencias 3.0, a program of the Central Bank of Argentina (BCRA), any digital wallet or banking app can read any payment QR code, and merchants are paid by immediate, irrevocable transfer. That interoperability is the system's strength and also the point to watch at checkout: if the QR code on a store's page is tampered with, any wallet will pay the scammer, and the system itself will not send the money back.

How the interoperable QR code works

The program was approved by BCRA Communication “A” 7153 and took effect on December 7, 2020. Communication “A” 7175 later replaced the original rule and organized the rollout in phases, with a final deadline of November 29, 2021. In 2022, Communication “A” 7463 added measures to mitigate, prevent and manage fraud in transfers.

The heart of the program is payment by transfer (PCT, from the Spanish pago con transferencia). According to the BCRA:

  • Any wallet reads any QR code. The brand on the code does not matter; payers use the wallet or bank of their choice, with a bank account (CBU) or a payment-provider account (CVU).
  • Funds are credited immediately. Immediate transfers are credited within 15 seconds at most, every day, around the clock.
  • Payments are irrevocable. Once the merchant is paid, there is no reversal through the system.
  • Costs are low. Buyers pay no fee; merchants pay between 6 and 8 per thousand, plus VAT.

A BCRA decision of August 2021 also required financial institutions to give business customers a QR code that identifies the receiving account, so payers no longer need to type a CBU, CVU or alias. The operating rules provide for static QR codes (with an open or fixed amount) and dynamic ones generated for each payment.

Adoption grew fast. In February 2023, the BCRA reported that one in four transfer payments already started with a QR scan, averaging 253,056 operations a day in the first half of January that year, versus 46,828 in the same period of 2022.

Why interoperability changes the risk

In closed systems, a fake QR code only works for users of the same wallet. Transferencias 3.0 requires the opposite: merchants must open their codes to the whole ecosystem, and wallets may not refuse to read them. That is great for consumers and merchants, and it means a tampered QR code is also accepted by any app.

Add irrevocability and crediting within seconds. By the time the payer realizes something went wrong, the money is already in the destination account. A refund, when there is one, depends on whoever received the money, and in a scam, that is the criminal.

Where tampering happens at checkout

In an online store, the Transferencias 3.0 QR code appears on a page that loads the platform, theme, plugins and third-party scripts. If one of those components is compromised, it can:

  • swap the dynamic QR code for another one, generated for a pass-through account, for the same amount;
  • replace the alias or CVU shown as an alternative to the QR code with a similar-looking identifier;
  • change the amount shown on a payment request.

The customer scans, pays and sees the confirmation in their own wallet. The store receives nothing. To the customer, the one to blame is whoever displayed the code: the store.

It is worth noting what lies beyond the page's reach: QR codes printed at the counter and fake messages sent outside the store are a different kind of fraud, with different defenses.

Checklist for merchants

  1. Prefer a dynamic QR code with a fixed amount for each order, instead of one open-amount static QR code shown to everyone.
  2. Show the account holder's name the customer will see in the wallet and ask them to check it before confirming.
  3. Release orders only when the credit is confirmed in your account, never on receipts or screenshots sent by the customer.
  4. Cut third-party scripts on the payment page and keep your platform, theme and plugins up to date.
  5. Monitor the live page, paying attention to complaints such as “I paid but my order doesn't show up.”
  6. Verify, in the customer's browser, that the QR code, alias or CVU and amount shown are the ones you issued, and block any mismatch before it is scanned.

How Proteside protects the interoperable QR code

Proteside runs on your payment page and checks, in the buyer's browser, that the QR code, alias or CVU and amount shown are exactly what your store issued, blocking any swap before the code is scanned or the payment confirmed. See Transferencias 3.0 payment protection and try it free for 14 days.

Back to blog

Read next