Make a captured code useless
A screenshot taken at the counter is worthless twenty seconds later, and worthless on any device other than the one that generated it.
Genies Pay / QR
A code that is only good here, only now, only on this phone.
QR acceptance is easy to build and hard to make safe. Three controls do most of the work: a short window, a device binding, and a verification step that checks both.
seconds until it refreshes · bound to this device
The flow, step by step
Generate
The cardholder's bank or wallet app generates an EMVCo customer-presented code through the QR SDK. Dynamic codes refresh every twenty seconds and are generated offline. Every code is bound to the registered device.
Scan
The merchant enters the amount on the Smart POS or SoftPOS application and scans the code.
Verify
The gateway decodes and validates the payload and verifies it with Secure Point against the device binding and the validity window, then runs the same merchant, terminal and fee validation as a card transaction.
Route
The request is routed to the issuer or wallet, the settlement entry is recorded, and the result returns. A timeout raises an automatic reversal.
Both directions
Customer-presented and merchant-presented.
| Mode | How it works | Where it fits |
|---|---|---|
| Customer-presented, dynamic | Generated in the customer's app, offline, refreshing every twenty seconds, bound to the device. | Attended counters with a scanner or a camera-equipped terminal. |
| Merchant-presented, dynamic | Displayed by the Smart POS or SoftPOS application for the amount being charged. | Where the customer scans rather than being scanned. |
| Merchant-presented, static | A printed code at the till, with the amount entered by the customer. | Small merchants, market stalls, unattended points. |
EMVCo QR conformance for the customer- and merchant-presented payloads is part of the certification workstream.
Honest limits
What these controls do, and what they do not.
Remove the need for the rest
Device binding and a short window are strong controls. They sit alongside risk rules, AML screening and scheme requirements — they do not replace them.
Next step
Put one in your hand.
Tell us your terminal models, your channels and whether the SDK is going into your own app. We come back with a rollout shape, a key-injection procedure and an EMV Level 3 certification schedule.