The biggest pandemic comeback story is the QR code, but are they safe for consumers?

The scannable black-and-white codes have become ubiquitous, and that has generally been seen as a good thing. Before 2020, most people probably gave very little thought to QR codes, but in the wake of the COVID-19 pandemic, their use soared. This has especially been true in the restaurant business, but think about all of the other uses that have cropped up—on proof-of-vaccination documents, for example, or as a means to aid humanitarian efforts. 

One of the most talked-about commercials to air during this year’s Super Bowl was also the simplest, consisting of a QR code that changed colors as it moved around the viewer’s screen. The ad for cryptocurrency exchange Coinbase clearly intrigued football fans; in fact, so many of them scanned the code that it caused the company’s app to crash when overwhelmed with traffic.

A tool for cybercriminals?

And then there was that FBI warning. On January 18, the Federal Bureau of Investigation issued a Public Service Announcement noting that “Businesses use QR codes legitimately to provide convenient contactless access and have used them more frequently during the COVID-19 pandemic.” However, the FBI also warned consumers that “cybercriminals are taking advantage of this technology by directing QR code scans to malicious sites to steal victim data, embedding malware to gain access to the victim’s device, and redirecting payment for cybercriminal use.”

Of course, the QR code itself is not inherently malicious—and in the restaurant industry, it has become a crucial part of doing business in the COVID era. The coronavirus compelled restaurant operators to implement contactless solutions to its many health and safety challenges. A code that patrons scan using their own phones was a natural solution to view menus, order and pay. Unsurprisingly, half of all full-service restaurant operators across the United States have implemented QR-code menus since the start of the pandemic; last August of 2021, CNBC reported a 750 percent increase in QR code usage over the preceding 18 months.

In its 2021 State of the Restaurant Industry Mid-Year Update, the National Restaurant Association reported that 57 percent of adults had viewed a restaurant menu online in the past year. A few outspoken editorial writers have authored pieces eagerly anticipating the end of the quick-response code era, but they are going to learn to love QR codes as restaurant operators continue to find new uses for them. Guests—especially those visiting full-service restaurant and quick-service restaurant businesses—tend to favor anything that makes their experience more convenient. In fact, more than half (52 percent) of all adults say they would like to see even more tech implemented to make ordering and paying easier.

Common-sense safety

With a bit of old-fashioned common sense, it’s easy enough for consumers to use QR codes in a safe manner. The most basic rule is to avoid scanning random codes and stick with those you know come from a trusted source. As cybersecurity firm Kaspersky points out: “The QR codes themselves can’t be hacked—the security risks associated with QR codes derive from the destination of QR codes rather than the codes themselves.” The QR code is just a convenient way to load a URL.

The FBI offers a few more tips, including the following:

• Check the URL of any QR code you scan to make sure it leads to the intended site and looks authentic.

• Exercise caution when entering login, personal, or financial information from a site reached via a QR code.

• If scanning a physical QR code, make sure it has not been tampered with in any way, such as a sticker placed over top of the original code.

• Do not download an app from a QR code; instead, use your phone’s app store for a safer download.

• If you receive an email purportedly from a company you recently made a purchase with, claiming that your payment has failed and that you must complete the payment through a QR code, call the company to verify. Make sure to find the company’s phone number through a trusted site, and do not use any numbers provided in the email.

• Both Android and iOS have a built-in QR code scanner through the camera app, which means there is no need to download a code-scanning app. Doing so increases the risk that you will download malware onto your device.

From a restaurant operator’s perspective, the QR code has the potential to become an engine for efficiency that, when well-oiled, can bring about generous returns. It deserves as much attention as keeping tables clean, or ensuring that payment terminals are functioning.  Implementing a process to audit QR codes on tables daily—which is as simple as having staff members walk around and scan them—should become standard. This security measure will also allow staff to determine whether the table’s QR code matches the table number in the POS system, which will eliminate confusion for both employees and guests.

When used properly, with the above safety protocols in mind, QR codes are perfectly safe. More than that, however, they can be a crucial lifeline for many businesses while also providing a welcome convenience to customers. 

With any luck, we will soon put the pandemic behind us—but here’s hoping the QR code comeback won’t be over anytime in the near future.

Laurent May is the CEO of Ready, a fully integrated mobile self-ordering, payment and loyalty technology solution that’s defining the next generation of hospitality venues. He has over 20 years of product management expertise in the electronic payments space leading high-performance teams.