The system in my country is that the QR code is meant to be public, and contains either your mobile number, or if you want to hide that, a UPI ID (which you can set and can be a random alphanumeric string). But having access to a person’s QR only lets you send money to them. The payment verification happens between the sender and the central database, on behalf of the sender’s bank, and can be done using a PIN / OTP.
For example, I go to a shop and buy sweets. The shopkeeper would have their QR code displayed prominently throughout the shop. I scan it to get their phone number / UPI ID, and then tell the app to send them so many rupees. The central database asks me to verify the payment. Once I verify, both I and the shopkeeper get an SMS saying x rupees was debited / credited. The app can also store transaction history in case there is any confusion later.
If I’m sending money to a friend, I already know their mobile number, so I can bypass the whole QR business and tell the app to just send money to their number.














But can the Gulf countries actually say no to the US? They don’t have Iran’s drone fleet or tunnel network, and are much more dependent financially on the dollar. I get the feeling that they’re caught between a rock and a hard place here. And at least some of those ‘accidents’ and ‘friendly fire’ could be them doing what they can get away with.