QR Codes for Business: What Works, What's a Gimmick, and What's a Liability

The genuinely excellent use cases

Some QR code applications are objectively better than what they replaced:

• WiFi access sharing. A QR code encoding WiFi credentials (the WIFI:URI format) eliminates the "what is the password?" interaction entirely. Guests scan, phone connects. No manual entry, no reading a small font password off a laminated card. iOS and Android handle this natively. This is one of the most underdeploy QR code use cases for offices, hotels, and cafés.
• Event and venue check-in. A QR code ticket is better than a paper ticket in every dimension: cannot be lost, cannot be counterfeited as easily, can be transferred digitally. The scanning process is faster than manual name lookup. For high-volume venues, the throughput improvement is significant.
• Product authentication and traceability.Luxury goods, pharmaceuticals, and food products use QR codes to provide scan-to-verify authentication. This is genuinely valuable: a consumer can verify a product is authentic, not counterfeit, and trace its supply chain origin.
• Contactless payment. QR-code-based payment systems (common in Asia, growing in Western markets) eliminate card fraud vectors associated with physical terminals. The model where the merchant displays a QR code and the customer scans to pay is security-superior to card skimming scenarios.

The gimmicks: QR codes that solve no real problem

Not every QR code deployment adds value. Some are pure theater:

• QR codes on websites. A QR code displayed on a webpage is one of the most absurd UX patterns in modern design. The user is already on the internet. On a device with a browser. Just use a hyperlink. The only scenario where a QR code on a website makes sense is when you want the user to open something on a different device — their phone, say, when they are on a desktop. That is niche enough that it should never be a default design pattern.
• QR codes on billboards at highway speed.This exists. Billboards with QR codes facing vehicles traveling at 70 mph exist in every major market. They cannot be scanned safely. They cannot be scanned effectively even unsafely. They are a design pattern that exists because someone thought QR codes were modern and nobody in the meeting pointed out the physics problem.
• Menus that link to PDFs. A QR code restaurant menu that opens a PDF is not a digital menu. It is a scanned physical menu with extra steps. PDFs zoom poorly on phones, cannot be searched, cannot be filtered by dietary restrictions, and do not update intelligently. If you are going to use a QR menu, build an actual web menu.

The liabilities: QR code security risks businesses ignore

The most serious business case against careless QR code deployment is security. QR code phishing (called "quishing" in security circles) has become a major attack vector precisely because QR codes have trained users to trust physical objects that display them.

The attack is simple: replace a legitimate QR code with one encoding a malicious URL. In restaurants, parking structures, and public spaces, physical QR codes are often printed on paper and affixed to surfaces — trivially replaced by an attacker with a printer. The victim scans what appears to be the official menu QR code and is directed to a credential-harvesting page that mimics a payment or login form.

Businesses deploying physical QR codes should: use tamper-evident labels, periodically verify codes by scanning them themselves, use domains that clearly belong to your organization (not a generic short URL service), and consider QR code monitoring services that alert on code replacement. Unmonitored physical QR codes in public locations are open attack surfaces.

Accessibility: the QR code exclusion problem

QR codes exclude users who do not have a smartphone, who cannot afford a data plan, or who have visual impairments that make scanning unreliable. When a QR code is the only way to access something — the only menu, the only check-in method, the only way to pay — you have built an accessibility barrier.

The correct approach is to treat QR codes as a convenience option, not a replacement. Offer the physical menu. Offer the staffed check-in desk. Offer card payment alongside QR payment. The QR code should make things faster for users who have the capability, not gatekeep services from those who do not. Any business that replaced all physical menus with QR-only during the pandemic and kept it that way has made a decision to exclude a segment of their customers — often the oldest and least tech-comfortable segment, who are also frequently high-value repeat customers.

The honest business case

QR codes are a tool. They are excellent for bridging physical objects to digital destinations, for contactless interactions, for high-volume scanning workflows. They are poor substitutes for hyperlinks, inaccessible to portions of your user base, and a security risk when deployed without monitoring. The businesses that benefit most from QR codes are those that deploy them intentionally, in contexts where they solve a specific friction point, while maintaining non-QR alternatives for accessibility. The businesses that create problems deploy them reflexively, because QR codes seem modern, without thinking through the operational and security implications.