A QR code is a shortcut from something physical to something digital, and it works when the shortcut removes real friction. It fails when it is added to material for the sake of appearing current, which is why so many go unscanned. The test is whether scanning is genuinely easier than the alternative.
Three uses that work, and one real risk.
Payments and ordering
Scan-to-pay is now common and genuinely useful: no card machine, no cash handling, and the customer uses an app they already have. For markets, deliveries and mobile services that removes the main reason a sale fails.
Scan-to-order works in food service, replacing printed menus and letting you change prices without reprinting. Confirm any payment provider is authorised with the Financial Sector Conduct Authority before adopting it.
Linking print to something useful
On packaging, a code leading to instructions, provenance information or a reorder page saves the customer typing a long address. On signage or a vehicle, it saves them remembering you later.
The code must lead somewhere genuinely useful and mobile-friendly. A code that opens a heavy homepage on an expensive data connection is worse than no code.
Where they fail
Codes on billboards people drive past, on television, or anywhere the person cannot comfortably scan. Codes with no explanation of what they do, since people will not scan an unlabelled square.
Always say what the code leads to, and always provide an alternative such as a short web address, because not every customer will scan one.
The security risk worth knowing
A QR code is unreadable to a human, which makes it an effective way to disguise a malicious destination. Codes stuck over legitimate ones, particularly on payment points, are a known fraud.
Check your own displayed codes regularly for tampering, and treat codes from unknown sources with the same caution as an unexpected link. Any customer data collected through a scan carries obligations under the Information Regulator.
Frequently asked questions
When is a QR code genuinely useful?
When scanning removes real friction: paying without a card machine, ordering without a printed menu, or avoiding typing a long address.
Why do most codes go unscanned?
Because they were added to look current, with no explanation of what they do and no benefit to scanning.
Where should codes not be used?
Anywhere the person cannot comfortably scan, such as billboards passed at speed or on television.
What should the code lead to?
Something immediately useful and mobile-friendly. A heavy homepage on expensive data is worse than no code.
What is the security risk?
Codes are unreadable to humans, so malicious ones can be stuck over legitimate codes, particularly at payment points. Check yours for tampering.
Further reading
Originally published in January 2018. Updated September 2026 into guidance on where QR codes genuinely help a business.
