Understanding QR Codes

QR codes themselves can’t be hacked, but there are security risks associated with the destination URL.

QR codes have been around since 1994, but clever people keep finding new and increasingly innovative ways to use them. To promote the science fiction series Halo, for example, Paramount+ recently launched 400 drones into the night sky over Austin, Texas. The drones formed a giant QR code that, when scanned, sent users to a trailer for the upcoming TV show.

The scannable black-and-white codes have also popped up in high-profile Super Bowl ads, on proof-of-vaccination documents, and as a means to aid humanitarian efforts. Prior to COVID-19, most of us likely gave little thought to QR codes, but in the wake of the pandemic, their use soared—especially in the hospitality industry, where they have in many cases supplanted physical menus and powered new methods of ordering and paying at restaurants.

A few recent headlines have raised questions about the safety of QR codes, however. In January, for example, the Federal Bureau of Investigation issued a Public Service Announcement that acknowledged the rising adoption of the technology: “Businesses use QR codes legitimately to provide convenient contactless access and have used them more frequently during the COVID-19 pandemic.” On the other hand, the FBI also warned consumers that “cybercriminals are taking advantage of this technology by directing QR code scans to malicious sites to steal victim data, embedding malware to gain access to the victim's device, and redirecting payment for cybercriminal use.”

The codes can’t be hacked

Cybercrime is most definitely a growing problem. According to one estimate, we can expect global cybercrime costs to increase by nearly 15% on a yearly basis over the next four years. Faced with this reality, you might feel inclined to hesitate before you scan another QR code. As cybersecurity firm Kaspersky points out, though: “The QR codes themselves can’t be hacked—the security risks associated with QR codes derive from the destination of QR codes rather than the codes themselves.” The code itself is not inherently dangerous—it’s just a convenient way to load a URL. 

When the coronavirus hit, introducing contactless technology helped many restaurants stay afloat. Placing a QR code decal on the table that opens an online version of the menu, for instance, saves restaurant operators the time and expense of disposing of single-use menus or sanitizing menus after each use. In its 2021 State of the Restaurant Industry Mid-Year Update, the National Restaurant Association reported that 57% of adults had viewed a restaurant menu online in the past year. More than half (52%) of all adults say they would like to see even more tech implemented to make ordering and paying easier, which should keep QR codes in business for some time to come.

In this time of supply-chain unpredictability and fluctuating commodity prices, being able to update and customize an interactive digital menu on the fly is invaluable. This technology allows restaurants to make changes in mere moments, such as removing sold out menu items, which helps avoid the inevitable disappointment of a customer who requests an item that’s listed but no longer available.

This technology can help restaurants in other ways, too. Combined with POS operational data, QR-code analytics can help restaurants keep track of customer behavior so they can assess what’s working and what needs to be adjusted to enhance the overall dining experience. If you can see, for example, that a guest ordered a particular item during their most recent visit, you can move that item to the top of the menu for next time. While you’re at it, you can also recommend that they add a salad or a side of onion rings to their order, which can boost revenue.

Common-sense safety

As for the question of safety, it’s really about using common sense. By following a few simple guidelines, customers can safely interact with QR codes. 

The most basic rule is to avoid scanning random codes and stick with those you know come from a trusted source. Before scanning a code on a table or countertop, make sure it has not been tampered with in any way, such as a sticker placed over top of the original code. Be very suspicious if the first thing you see is a credit card screen. In the case of pay at the table, you should ensure the first screen you see includes the actual items you ordered. Also, since both Android and iOS have QR code scanners built into their camera apps, there is no need to download a separate code-scanning app to your mobile device. Doing so increases your risk of downloading malware onto your device.

QR codes aren't going anywhere, at least not in the near future. They have been a crucial lifeline for many businesses, while also providing much-appreciated convenience to customers. Hospitality operators may have only scratched the surface of its potential to increase efficiencies and deliver generous returns.

The best part is that when used with a few simple precautions, following the above security protocols in mind, QR codes are perfectly safe. 

About the Author

Laurent May is the CEO of Ready, a fully integrated mobile self-ordering, payment and loyalty technology solution that’s defining the next generation of hospitality venues. He has over 20 years of product management expertise in the electronic payments space leading high-performance teams.