How a DuitNow QR payment differs from an ordinary transfer

What the code contains, and what it does not

A DuitNow QR code carries routing data — who is being paid, and for a transaction-specific code, how much. It does not carry your money, your account number or your credentials. Scanning it does not transfer anything; it populates a payment instruction inside your own app, which you then authorise with your own PIN or biometric.

That distinction is the security model. Your bank app never hands details to the merchant, and the merchant never sees your credentials. It is also why the QR code itself is not sensitive: a photograph of a payment code is a photograph of an instruction to pay someone, which is useless to anyone except a person voluntarily paying.

There are two shapes of code in circulation, and the XTC88 cashier uses only one of them. A static code identifies the recipient only and you type the amount. A dynamic code carries a specific amount for a specific transaction and expires. A cashier deposit uses the dynamic kind, which is why the amount is already filled in when you scan and why an old screenshot points at nothing.

Who operates the rail

DuitNow QR is the national QR standard, operated by Payments Network Malaysia, the shared infrastructure operator that also runs the interbank transfer services Malaysian banks use between each other. The consumer-facing description of the service is published on the operator's own site.

The practical consequence of a single shared standard is interoperability. Before it, a QR code belonged to one wallet and was useless in any other app. Now one code accepts payment from participating banks and wallets alike, which is why the cashier can offer a single QR option instead of one per issuer.

It also means the rail is not owned by whoever you are paying. The XTC88 cashier generates a request; the movement itself happens on infrastructure neither party controls, which is what makes the settlement fast and the outcome final.

Where the limits actually come from

There is a persistent assumption that the merchant sets the QR limit. It does not. The cap that stops a scan is the transfer limit configured in your own banking or wallet app, and many people have never changed it since the account was opened.

This is worth knowing because the symptom is misleading, and XTC88 has no visibility of that figure at all. A refused QR payment looks like a problem with the code or with the recipient, and the fix is entirely on your side — raise the limit in your app, or switch rails. If a wallet is the source, the wallet's own balance ceiling applies on top of that, which the guide to depositing from TNG eWallet covers in detail.

For amounts large enough to run into either cap, the sensible move is not to split the payment into several scans. Use the banking rail for larger single amounts instead, because one traceable transfer is far easier to reconcile than four that each need matching.

When a QR deposit does not credit

Three causes account for nearly all of them, and they are distinguishable in seconds.

The code expired before authorisation. Dynamic codes are transaction-specific and short lived; generate a fresh one rather than rescanning. The amount was edited after scanning, producing a payment that does not match the request it was generated for — cancel and start again rather than adjusting. Or the payment simply has not been matched yet, in which case the transaction reference from your app is what resolves it.

Keep that reference. Every banking and wallet app produces one, and it is the difference between a support conversation that takes one lookup and one that takes a wide search.

Occasionally the route itself is the problem rather than your payment. Individual issuers take their own systems down for maintenance, so a QR option that worked yesterday can be temporarily absent today; the live channel list sits in the cashier at xtc88.my rather than in this guide, because it changes on the issuer's schedule and not on ours. Support runs on live chat around the clock in English and Bahasa Malaysia.

Operator documentation for this rail changes as the standard is extended, so the description above is re-checked against the source on each revision — how payment information here is sourced and reviewed.