What Is the EPC QR Code (GiroCode)?

In Europe you may have seen a small square QR code on an invoice, a donation appeal or a payment request at a checkout. Most of the time this is the standard we call the EPC QR code — commonly known in German-speaking countries as the GiroCode. Its purpose is simple: to pre-fill a euro transfer with a single tap in a bank app, without entering the IBAN by hand. In this guide we explain what the EPC QR code is, what information it carries inside, how it works, and its situation in Turkey.

What exactly is the EPC QR code?

The EPC QR code is a data format defined by the European Payments Council in its guideline titled EPC069-12. Inside the QR code, the information needed to initiate a SEPA credit transfer (SCT) is placed as plain text: the payee's name, their IBAN, the amount to be sent, the remittance and a few control fields. When a bank app reads this code, it fills the fields on the transfer screen with this information.

The critical point is this: the EPC QR code is not a payment instrument but a data carrier. The code moves no money, accesses no account and contains no authorisation. It only carries the "send this amount, to this payee, to this IBAN" information in a machine-readable form. The one who initiates the payment, sees the amount and the payee on the screen and confirms it, is still the user. In this respect the GiroCode is a convenience that eliminates the typing errors caused by entering an IBAN by hand — not a layer of security or authorisation.

What fields are inside the QR code?

The content of the EPC QR code follows a fixed field order arranged line by line. The table below summarises these fields and what they are for, according to EPC069-12.

Field	Description
Service Tag	A fixed value indicating the type of the code: BCD. It tells the app "this is an EPC payment code".
Version	The version of the code format (e.g. 001 / 002). The version affects whether the BIC field is mandatory.
Character set	Indicates in which encoding the text is written (e.g. UTF-8). It matters for special characters in the payee name and the remittance.
Identification	The transaction type: SCT for a SEPA credit transfer.
BIC (optional)	The BIC/SWIFT code of the payee's bank. In newer versions it is usually not mandatory for payments within SEPA.
Beneficiary	The name of the person or organisation that will receive the money. Mandatory.
IBAN	The payee's IBAN. Mandatory, and only IBANs within the SEPA area are accepted.
Amount (EUR)	The amount to be sent — only in euros. If left blank, the user enters the amount themselves (e.g. in donations).
Purpose	An optional code indicating the purpose of the payment (ISO 20022 purpose codes). It is left blank in most payments.
Reference (structured)	A creditor reference in the ISO 11649 "RF" format, with a check digit. Used for automatic reconciliation.
Remittance (unstructured)	Unstructured free-text remittance. Used instead of, not together with, the structured reference.
Information	An optional additional note to be shown to the user.

There is a choice between the structured reference and the free-text remittance fields: if a piece of software is going to match the payment automatically, the structured RF reference is more suitable; if a human is going to read it, the free-text remittance is. You can find this distinction and the character limits in detail in the SEPA payment reference and purpose codes guide.

Only euros and SEPA IBANs

The EPC QR code is, by definition, for a SEPA credit transfer; this brings two limits. First, the amount it carries can only be in euros — another currency (dollar, pound, Turkish lira) cannot be expressed with this code. Second, the payee account must be a SEPA area IBAN. The code is, by definition, not designed to initiate a SWIFT transfer to a non-SEPA account.

How does it work step by step?

The whole process consists of carrying the data; the only step that moves the money is at the very end and is in the user's hands:

• An organisation (a seller, an association, an invoice issuer) encodes the payee name, the IBAN, the amount and the remittance into an EPC QR code and prints it on the invoice or on a screen.
• The person who is going to pay opens the QR scanning feature in the app of their bank in the SEPA region and scans the code.
• The app decodes the fields in the code and fills in the transfer form automatically — the IBAN is not typed by hand.
• The user checks the payee, the IBAN and the amount on the screen and confirms the payment.
• Only after this confirmation does the bank initiate the actual SEPA credit transfer.

If you would like to see how an EPC QR code is produced and to create a code with your own payment details, you can use the SEPA / EPC QR (GiroCode) generator tool that runs entirely in your browser. It is useful to read while using this tool together with the How to make a SEPA transfer? guide, which explains step by step how to initiate a real SEPA transfer.

Security: see the fields before scanning

The convenience the EPC QR code brings also carries a risk: the IBAN and the amount inside the QR code cannot be read with the naked eye. A malicious person could stick a fake QR code containing their own IBAN over a real invoice; if you scan the code and confirm it without thinking, the money can go to the wrong account. In Europe, these kinds of "sticking a fake label over the QR" frauds are a known case.

The way to protect yourself is simple: before confirming the payment, always check on the screen the IBAN, the payee name and the amount the app has filled in. The QR code only fills in the form; you have the final say. Do not scan a QR code from a source you do not trust, and make sure the amount is the value you expect. A mathematically valid IBAN does not prove that the account belongs to the correct payee — that is why it is important to verify the payee name and the IBAN together.

Summary

The EPC QR code (GiroCode) is a QR code defined in the EPC069-12 standard that pre-fills a SEPA credit transfer. Inside it carries the payee name, the IBAN, the euro amount, the remittance and purpose/reference fields; it does not make the payment itself, it only carries the data, and the final confirmation is with the user. It works only with euros and SEPA IBANs; because Turkey is outside SEPA, Turkish bank apps generally do not support this code. Because it brings the risk of a fake QR along with its convenience, always check the IBAN and the amount before confirming.