§ 53-447.  (Effective January 1, 2027) Prohibition on QR code or scan-based login.

(a) Ban on QR Code, Barcode, and Similar Login Methods. - A kiosk operator shall not implement any feature, workflow, or device that enables a customer to access, authenticate, or log in to an account, wallet, or transaction interface through a QR code, barcode, or similar scan-based mechanism, including any of the following:

(1) Scanning a code displayed on a mobile device.

(2) Scanning a printed code linked to a customer account.

(3) Using a camera-based or optical-reader login process that substitutes for manual entry.

(b) Permitted Authentication Methods. - Customer authentication at a virtual currency kiosk is limited to any of the following:

(1) Manual entry of a phone number, account identifier, or other unique customer credential.

(2) Manual entry of any verification code sent to the customer.

(3) An additional authentication method approved by the Commissioner that does not rely on optical scanning or automated code-reading.

(c) Technical Safeguards. - Each kiosk shall disable or physically block any camera, optical reader, or scanning component unless required for identity-verification purposes expressly authorized by this Article and approved by the Commissioner.  (2026-45, s. 1.)