UniQR: A Secure QR Code Payment Scheme Using Device Pose and Environmental Matching

The convenience of QR codes has made them increasingly popular in the field of mobile payments, with many payment service providers (e.g., PayPal, Alipay, WeChat) offering QR code payment services. However, due to the openness of QR code scanning process, attackers can capture the code and perform fraudulent transactions before the original QR code is used, posing a significant security threat. In this paper, we design UniQR (Unique QR), which embeds device pose information as “physically unclonable” fingerprints into the QR code to prevent attackers from unauthorized use of it. We propose a pose matching method based on Perspective-n-Point (PnP) algorithm and the integrated sensors of the phone to bind the QR code to the payment device. This information binding effectively enhances the security of QR code payments. Additionally, we modify the QR code encoding using a segmented hybrid encoding method, allowing secure authentication information to be embedded by utilizing only a portion of the space originally designated for dummy data. We implemented UniQR on six different commercial phones and conducted experiments with 23 participants simulating both legitimate and illegitimate payment scenarios. The 97.46% success rate in legitimate user scans demonstrates the feasibility and robustness of UniQR.