bank · 4 min read

CBE Receipt QR Codes: What They Contain and How to Scan Them

CBE's new receipt sharing system uses short URLs and QR codes. Learn what's inside them, how to scan them, and how to verify instantly with cheki.

Commercial Bank of Ethiopia recently launched a new receipt sharing system. When you complete a transfer in the CBE mobile app, you can now share a short link like https://mbreciept.cbe.com.et/fHCxyV4mg5pRIwEkJO. The recipient opens this link and sees the full receipt in their browser, no app required.

This is a significant upgrade from the old system, which required the FT reference number and the last 8 digits of the receiving account to construct a receipt URL. The new system uses a single short ID and returns clean JSON data instead of a PDF.

What the QR code contains

The QR code on a CBE receipt encodes a URL in this format:

https://mbreciept.cbe.com.et/{SHORT_ID}

The short ID is a random string like fHCxyV4mg5pRIwEkJO. It maps to a single transaction on CBE's backend. When you scan the QR code, you get this URL, which you can paste into cheki's URL input mode to verify instantly.

The API behind the receipts

The mbreciept.cbe.com.et page is a Nuxt.js single-page app. When it loads, it calls a JSON API at a different domain:

GET https://Mb.cbe.com.et/api/v1/transactions/public/transaction-detail/{SHORT_ID}

Headers:
  X-App-ID: d1292e42-7400-49de-a2d3-9731caa4c819
  X-App-Version: 0a01980b-9859-1369-8198-59f403820000

The response is structured JSON with all the transaction details:

{
  "id": "FT2614977L8S",
  "transactionType": "ACNX",
  "debitAccountNo": "1********8348",
  "creditAccountNo": "1********6171",
  "amountCredited": "1300.00",
  "creditCurrency": "ETB",
  "dateTimes": ["2026-05-29T08:30:00Z"],
  "debitAccountHolder": "Raeed Ansar Yusuf",
  "creditAccountHolder": "Sami Adil Zekaria",
  "paymentDetails": ["football 1mo and extratime"]
}

cheki uses this API directly. When you paste a mbreciept link, cheki extracts the short ID, calls the JSON API, and returns the parsed result. No PDF parsing needed, which makes it faster and more reliable than the old endpoint.

Old vs new CBE receipt system

How to scan a CBE QR code with cheki

Privacy and security

The new CBE receipt system masks account numbers in the API response. Instead of showing the full account number, it returns a masked version like 1********8348. This is better for privacy than the old PDF system, which included full account numbers in the document text.

The short ID in the URL is random and not guessable, which prevents receipt enumeration. You can only access a receipt if someone shares the link with you.

Inside the short ID: what we found

We reverse-engineered the token format. The short ID in a v1 mbreciept URL (like fHCxyV4mg5pRIwEkJO) is standard base64url encoding of 13 bytes. The first 3 bytes are a fixed header (7c70b1 — which is why all v1 tokens start with "fHCx"). The remaining 10 bytes are an encrypted payload containing the transaction's FT reference.

The encryption uses a keyed cipher with per-token seeding. We verified this by comparing multiple tokens: the same plaintext byte at the same position produces different ciphertext bytes across receipts. This rules out simple encoding schemes (XOR, base-N packing, substitution) and confirms the payload is cryptographically protected.

CBE's server validates tokens cryptographically. If you submit an old FT reference to the new API, it rejects it with "Security Alert: Invalid or tampered legacy token!" This is intentional — the new system prevents receipt enumeration. With the old system, anyone could guess FT references and pull receipts. With tokens, you can only verify receipts that were explicitly shared with you.

CBE has already shipped a v2 token format. Newer receipts use URLs like https://mbreciept.cbe.com.et/v2-hfHCxFU3NsED8vF... — note the v2- prefix. The v2 payload is 15 bytes (vs v1's 13) and uses a different layout. Both v1 and v2 tokens work on the same API endpoint. cheki passes the full token through unchanged, so both formats work automatically.