QR Codes for Retail: 8 Ways to Use Them in Your Store

Retailers use QR codes for eight main jobs: shelf-edge product information, payments, loyalty signup, review collection, stock and restocking, staff training, digital receipts, and out-of-hours window displays. Every one of them replaces something that used to need printed paper, a staff member, or a queue. Most cost nothing to set up.

But there is a bigger reason retailers are paying attention right now, and it has nothing to do with marketing. The barcode on the back of your products is being replaced.

Why are QR codes suddenly everywhere in retail?

Because the retail industry set itself a deadline, and it lands at the end of next year.

GS1, the standards body that issues the barcodes on virtually every product you sell, is running an initiative called Sunrise 2027. It is a global transition from the familiar 1D UPC barcode to 2D codes like QR. The target is that by 2027, retail point-of-sale systems can read 2D barcodes and brands have made their products 2D-enabled. In practice that means installing scanners GS1 describes as Sunrise-capable, able to read a 2D code and pull the GTIN out of it at the till.

Worth being accurate about what this is. It is an industry milestone, not a law, and GS1 says explicitly that it is not necessary to implement every 2D capability by that date. Nobody is going to fine you. But if your scanners cannot read a 2D code and your suppliers start shipping products carrying them, that is your problem at the checkout, not theirs.

The scale of it is what makes it hard to sit out. GS1 puts 48 countries, representing roughly 88 percent of global GDP, as actively preparing for the switch. Note that phasing out the old linear barcode is not part of the plan, so the practical advice during the transition is dual barcoding: print both the 2D code and the EAN or UPC so the product scans wherever it lands.

How does one code work at the till and on a phone?

This is the part that makes the whole transition worth caring about, and most coverage skips it. You don't end up with two codes doing two jobs. You end up with one.

The mechanism is a standard called GS1 Digital Link, which structures what the code contains as a web address that also carries the GTIN. GS1's implementation guideline for 2D barcodes at retail point of sale spells out both halves. The code is consumer scannable with a mobile device's default camera app, needing no special app. And a software-enabled imaging scanner at the till decodes that same symbol and pulls the GTIN out of it.

So the shopper scanning your shelf gets ingredients or sizing, and the identical square rings up the sale. That also explains the point further down about a free generator not producing a till-scannable code. The difference isn't the QR code itself. It's whether the contents follow GS1's syntax and whether the number inside is one GS1 issued to you.

On the dual-barcode advice above, GS1 attaches a specific condition to when you can stop. Until 90 percent of point-of-sale scanning solutions can handle GS1-compliant 2D barcodes and capture the GTIN at minimum, any product carrying a retail 2D barcode still needs a linear barcode alongside it. So dual marking isn't a cautious personal preference. It's the guideline, and the trigger for dropping the old barcode is an industry readiness number rather than a date on your calendar.

GS1 US frames the retailer side as crawl, walk, run, which is more honest than most transition advice. Crawl is installing scanners that read a 2D code and extract the GTIN at the till. Walk is putting 2D barcodes on your own private-brand products. Run is reworking internal processes around what the richer data unlocks, meaning recalls, traceability and stock accuracy. If you only ever manage the crawl step, you're still fine at checkout, which is the reassuring part of this.

One caution on scanners before you budget. GS1 notes the change needs software upgrades and may need new equipment if your scanner isn't already imager capable. A laser scanner reads a single line and cannot read a 2D code however you configure it, so the first honest question about your existing till is which of the two you actually have.

That is all the industry pushing. The fair question is whether shoppers are pulling in the same direction, because a scanner upgrade is a lot easier to sign off if they are. GS1 US ran a consumer survey in 2025 and found 79 percent prefer products carrying a scannable QR code that offers extra information, with 77 percent saying product information factors into their purchase decision. The third figure is the one with a commercial edge: 62 percent said they would pay more for detailed product information.

Hold that last one loosely. It is a stated preference, collected in a survey run by the body promoting the standard, and what people say they would pay is not money across a counter. But even discounted heavily it points somewhere useful. The code is not just a compliance box to tick. It is somewhere to put the answer to the question a shopper would otherwise have to hunt down a staff member to ask, and on a busy Saturday that is worth something on its own.

There is a second push coming from regulation. The European Commission's Ecodesign for Sustainable Products Regulation entered into force on 18 July 2024, with a transition regime running to 2030. It introduces the Digital Product Passport, and the Commission is currently adopting the rules on the identifiers and data carriers that will carry it. The first working plan was published in April 2025 and prioritises textiles and steel, with consumer electronics including smartphones, tablets and solar panels in the queue behind them.

If you sell any of those categories into Europe, a scannable code on the product is heading your way. Even if you do not, the direction is clear enough: the little square is becoming part of the product, not just part of the poster.

In some markets the shift has already happened at the counter. Payments Network Malaysia (PayNet), the national payments operator, reported in April 2026 that 681,250 new DuitNow QR acceptance points went live during 2025, taking the country past three million registered touchpoints. Of those new points, 267,780 were micro, small and medium enterprises.

That last number is the one to sit with if you run a small shop. Roughly a quarter of a million businesses your size added a QR acceptance point in a single year, which means your customers have almost certainly been trained to scan somewhere else already. You are not teaching them a new behaviour. You are deciding whether to meet one they have. Cross-border QR transactions grew two and a half times over the same year, to 29.7 million, so the tourist standing in your shop may well be expecting to pay this way too.

Singapore went the other way and collapsed the sticker wall

Malaysia's story is about adding acceptance points. Singapore's is about getting rid of clutter, which is the problem a lot of shopkeepers actually have.

You know the counter display. Six or seven QR stickers taped up in a row, one per wallet, each from a different provider, each reconciling separately. NETS announced the islandwide rollout of SGQR+ on 7 November 2024 to fix exactly that, following a proof of concept the year before.

The headline number is the one worth reading twice. During the proof of concept, the average number of payment schemes accepted per participating merchant went from three to twelve. Same single label on the counter, four times the wallets it accepts.

The commercial rollout covered 24,000 acceptance points islandwide across roughly 16,500 merchants, rising past 35,000 points once the hawker segment wallets were included. Food and beverage and retail were the two focus sectors, and NETS set a target of growing acceptance points 10 percent year on year. The ecosystem now runs to 18 payment schemes and issuers.

But the operational change matters more than any of those figures. Before SGQR+, a merchant accepting several schemes had to manage a separate acquirer relationship for each one and reconcile them all separately. Under SGQR+ you consolidate onto a single merchant acquirer. If you have ever spent a Monday morning matching four settlement reports against one day's takings, that is the part that buys back your time.

So the Singapore version of this advice is short. One label, one acquirer, and stop printing new stickers every time a wallet launches.

What are the 8 best ways to use QR codes in a store?

Ranked roughly by how much value they deliver for the effort involved.

1. Shelf-edge product information. The best one, and the most underused. A shopper holding a jar is already wondering something: what is in it, will it fit, how do I wash it. A code on the shelf label answers that without a staff member and without printing a booklet. Ingredients, sizing charts, care instructions, allergens, reviews.
2. Payment. Across Southeast Asia this is table stakes. Singapore has PayNow and SGQR, Malaysia has DuitNow, Thailand PromptPay, Indonesia QRIS, the Philippines QR Ph. Get these from your bank or payment provider rather than a generator, since they carry merchant data that has to be issued to you. If you are in Singapore and still running a row of separate stickers, ask your acquirer about moving to a single SGQR+ label. Our QR code payment guide covers the setup, and the Singapore QR payments guide goes deeper on SGQR and PayNow specifically.
3. Loyalty signup. A code at the till turns a thirty-second form into a five-second scan. The moment right after payment is the only time a customer will reliably do this, so put it where they are already standing.
4. Reviews. Link straight to your Google review page. Most shops never ask, and asking at the counter with a code beats asking by email three days later when the visit has faded.
5. Restock and stock checks. A code on a shelf or in a stockroom that opens the right supplier order form, or a stock sheet. This one is for your team rather than your customers, and it saves more time than the customer-facing ones.
6. Staff training. Codes on equipment linking to the how-to video or the cleaning procedure. Particularly useful in shops with part-time or rotating staff who will not remember a laminated sheet from three weeks ago.
7. Digital receipts. A code that pulls up the receipt, warranty registration or returns policy. Cuts paper, and it means the returns policy is still findable when the customer comes back in six weeks having lost the slip.
8. Window displays. The one that works when you are closed. A code in the window linking to your catalogue, opening hours or online store captures the person who walked past at 9pm. Make this one large, because they are scanning from further away and possibly through glass.

Start with one or two. A shop with eight codes and no plan just looks cluttered, and shoppers stop scanning any of them.

Can a tourist pay with their home country's app?

Usually yes, and the good news is you probably don't need to do anything. The code already on your counter is the one they scan.

This is the part most shopkeepers miss, because it sounds like it should need new equipment. It doesn't. Central banks across the region have linked their national QR schemes to each other, so a visitor opens their normal home banking app, scans your normal local code, and the currency conversion and settlement happen behind the scenes. You get paid in your own currency as usual.

The Bank of Thailand publishes the clearest list of who is connected to whom, and it runs to ten countries and regions: Cambodia's KHQR, Malaysia's DuitNow, Vietnam's VietQR, Singapore's NETS QR and PayNow, Indonesia's QRIS, Hong Kong's FPS, Lao PDR, Korea, Japan and China. The Lao linkage went live across April and June 2024, so this list is still growing rather than finished.

Singapore and Malaysia connected NETS QR to DuitNow QR on 31 March 2023. The wider framework behind all of it is a Memorandum of Understanding on Regional Payment Connectivity signed in November 2022 by the central banks of Indonesia, Malaysia, the Philippines, Singapore and Thailand, with Vietnam joining in August 2023.

The demand is already there. PayNet's figure quoted earlier, cross-border QR transactions growing two and a half times in a single year to 29.7 million, is what this looks like from the shop floor.

What does a shopkeeper actually need to do?

• Ask your acquirer whether your code is enabled for inbound cross-border. Coverage depends on your acquirer and which schemes they've joined, not on anything you buy. It's a question, not a purchase.
• Don't print a separate tourist QR. That's the sticker wall problem coming back. One label is the whole point of these linkages.
• Know that some linkages run the other way. Bank of Thailand notes the Japan connection works by the customer generating a buyer code that the merchant scans, rather than the customer scanning yours. If your acquirer supports that direction, your till may need to scan as well as display.
• The exchange rate isn't yours. The visitor's own bank sets the rate and any fee on their side. If someone questions the rate at your counter, that conversation belongs with their bank, and knowing that saves you an argument.
• Check the merchant name that appears on their phone. Same habit as the tampering check further down. If a foreign wallet shows a name that isn't yours, stop and find out why.

One caveat worth stating plainly. Which specific wallets work in your shop depends on your acquirer, the scheme, and the visitor's own bank, and all three change. So treat the list above as the direction of travel rather than a guarantee that any particular tourist's app will work on any particular day.

Will products on your shelves need a Digital Product Passport?

Some of them, and sooner than most shopkeepers realise. Sunrise 2027 is about the barcode you scan at the till. The Digital Product Passport is about a second QR code, put there by the manufacturer, that opens up what a product is made of and what happens to it at the end of its life. Two different codes, two different reasons, and they are going to land in the same shops around the same time.

The first hard deadline is a date rather than an intention. From 18 February 2027 the battery passport becomes mandatory for relevant battery categories placed on the EU market, and the European Commission is explicit that it is linked to the battery through a QR code. It covers electric vehicle batteries, the batteries in e-bikes, e-mopeds and e-scooters, home storage batteries and industrial batteries.

There is a wider bit of that rule worth knowing if you sell batteries of any kind. Under the EU Batteries Regulation, from the same date all batteries have to carry a QR code, not only the ones that need a full passport behind it. The code has to be printed or engraved on the battery itself where that is practical, and where it is not, on the packaging or the accompanying documents. So the plain AA multipack on a shelf is in scope for the code even though it is not in scope for the passport.

Batteries are just the first product group. The Digital Product Passport sits inside the EU's Ecodesign for Sustainable Products Regulation, which the guide mentions earlier, and the Commission is working through product groups one at a time with textiles, furniture, tyres and steel among the priorities. Those arrive through separate rules on their own timelines, so treat batteries as the one with a firm date and the rest as coming rather than here.

Now the part that matters if you run a shop rather than a factory. Almost none of this is your job. The passport is the manufacturer's obligation, the data sits on their systems, and you are not expected to build or host anything. Nobody is going to ask a corner shop to publish recycling data for a pack of batteries.

What is your job is not breaking the code once the stock is on your shelf. That means not putting a price sticker, a promo flash or a security tag over a QR code on packaging, which is the single most common way these get killed in store, and it is the same failure the section below on scanning problems describes. If you repackage or relabel anything, keep the original code visible. And if a customer scans one and lands somewhere confusing, that is the brand's page, not yours, so the useful move is to tell your supplier rather than field the question yourself.

One honest caveat on scope. These are EU rules, and if you sell nowhere near the EU you are not bound by them. But packaging is usually designed once for a global run, so codes that exist to satisfy Brussels tend to end up on shelves everywhere. Expect to see them regardless of where you trade.

Which QR code type should a retailer use?

Static for anything permanent, dynamic for anything you will change.

Static codes encode the destination directly. They are free, they never expire, and nobody can switch them off. That makes them right for WiFi access, your review link, your payment display and shelf information that is not going to move. The catch is that the destination is fixed forever, so if the URL changes you reprint.

Dynamic codes point at a redirect you control, so you can change where they go and see scan counts. That is genuinely useful for a seasonal campaign or a promotion you want to measure. It also means a monthly subscription, and it means your codes stop working if you stop paying. For a shop, that risk matters more than it does for a one-off campaign. Our static versus dynamic comparison goes through the trade-off properly.

The practical answer for most retailers: static for the permanent fixtures, dynamic only for campaigns with a defined end date.

Which spots work best for QR codes in a shop?

Where the customer already is, at the height they already look, with a reason to scan written next to it.

• Eye level or just below. Codes near the floor get ignored. Codes above head height cannot be scanned without a stretch.
• Where people naturally pause. The queue, the fitting room, the shelf edge. Nobody scans while walking.
• Never behind glass with a spotlight on it. Glare kills more scans than anything else in a shop.
• Always with a line of text. "Scan for sizing" gets scanned. A bare code does not. People need to know what they are getting before they lift their phone.

How big does a retail QR code need to be?

Use the ten to one rule: a code scans reliably from roughly ten times its own width. So a 2cm code works from about 20cm, which is right for a shelf label or a product tag where the shopper is standing close.

Scale up from there. A code on a counter sign that people scan from arm's length wants around 3cm to 4cm. A window display code being scanned from the pavement, maybe two metres away, needs to be 20cm across. That surprises people, and it is why so many window codes fail.

Leave a clear margin of empty space around the code, at least the width of four modules, and do not let packaging text crowd it. Our QR code size guide has the full table, and the print design guide covers contrast and materials.

What makes a retail QR code fail?

Almost always something physical, not something technical.

Too small for the distance is the most common. Glare from laminate, glass or a spotlight is the second. Poor contrast comes third, and it is usually a designer choosing light grey on white because it looked cleaner in the mockup. Then there are codes placed somewhere nobody stands, codes half hidden behind a product display, and codes on high-traffic surfaces that get scuffed until the pattern breaks.

There is one fix that catches nearly all of this. Print a test copy, put it in the exact spot at the exact size, and scan it yourself with an older phone in the actual store lighting. Do that before you commit to a print run of a thousand shelf labels, not after.

One more thing worth knowing. QR codes have built-in error correction, so a code can still scan with part of it damaged or covered by a logo. That tolerance is real but it is not unlimited, and it does not rescue a code that was printed too small in the first place.

What about customers who cannot or will not scan?

Keep a path that doesn't need a phone. This is the rule that saves you from the single worst QR mistake in retail, which is making the code the only way to do something.

Smartphone ownership in Singapore is close to universal in aggregate, and that headline hides the group standing in your shop. A research brief from the Centre for Research on Successful Ageing at Singapore Management University, drawing on IMDA survey data, put smartphone use among residents aged 75 and above at 48 percent in 2021, up from 28 percent in 2017. Rising fast, and still roughly half of that age group without one. IMDA runs Seniors Go Digital precisely because the gap is real enough to need a national programme.

And it isn't only about age. On any given day some of your customers have a dead battery, a cracked camera lens, no mobile data, a work phone locked down by IT, or a tourist SIM with roaming switched off. Some simply don't want to point their camera at a sticker in a shop, which after the scam coverage is a reasonable position rather than a stubborn one.

There is a much larger dataset pointing the same way, and usefully it has nothing to do with anyone selling QR codes. The European Central Bank's SPACE study surveyed 40,981 consumers across 18 euro area countries, in fieldwork running from late 2023 into mid 2024. Two of its findings sit directly on this question and they pull in opposite directions, which is what makes them worth reading together.

The first is that digital genuinely is winning. Cash fell to 52 percent of point-of-sale transactions by number in 2024, down from 59 percent in 2022, and by value to 39 percent from 42 percent. Payments made with a mobile device almost doubled over the same two years, to 6 percent. Read only that and you would conclude the phone-free path is a shrinking problem you can stop worrying about.

The second finding says otherwise. Over exactly the same period, the share of consumers who consider it important or very important to have cash as a payment option went up, from 60 percent to 62 percent. People are using cash less and wanting it available more. Those two things only look contradictory until you notice that this is what a fallback is: the thing you rarely reach for and strongly object to losing.

Which means the pressure on a code-only setup does not ease as adoption climbs. It runs the other way. And that is measured across 18 countries and 40,000 people rather than inferred from one market or one vendor's dashboard.

So the working rules:

• Print the short URL underneath the code. Costs nothing, and it rescues everyone whose camera is the problem rather than their willingness.
• Never put safety information behind a code alone. Allergens, warnings and ingredient lists need to be readable without a device. Treat a code as the place for the fuller version, never the only version.
• Never make a code the only way to pay. Keep cash or card at the counter. A shop that can only take one payment method turns away the customer who can't use it.
• Keep prices on the shelf. A code that reveals the price is a code most shoppers will skip, and it reads as something to hide.
• Have a staff answer ready. If a customer says the code isn't working, the response should be help, not a repeat of the instruction.

None of this means using fewer codes. It means the code is the fast lane rather than the only lane, which is also the version that keeps working when your wifi goes down.

What language should the page behind the code be in?

Whatever your customer reads, which is not always the language on your shelf label. The code itself is language-neutral. Every phone on earth decodes the same pattern the same way. It's the page on the other side where you lose people.

This matters more than most shopkeepers assume, and it isn't only a tourist problem. Plenty of shops serve customers who live locally and read something other than the local official language. Border towns, university districts, neighbourhoods with long-settled migrant communities. A shopper who can't read your allergen page is in exactly the same position as a shopper who never scanned at all, except you've now spent money printing the code.

Should you print one code per language?

No. Print one, and handle the language on the server.

Four codes on a shelf edge is clutter, it quadruples your reprint cost when anything changes, and it forces the customer to identify their own flag before they've read a word. It also breaks the thing that makes a single permanent code worth having, which the static and dynamic section further up gets into.

What works better is one destination that decides what to serve:

• Detect the browser language and serve that first. Phones send their language preference with every request. It's the cheapest signal you have and it's right most of the time.
• Put a visible language switcher at the top anyway. Auto-detection gets it wrong often enough to matter. A phone bought secondhand, a handset set to English by someone who reads Thai, a tourist on a roaming SIM. If the switch is buried in a footer, it doesn't exist.
• Keep the URL the same across languages. The printed code should never need to change because you added a language. Add the language as a parameter or a path segment behind the same entry point.
• Start with two or three, not twelve. Look at who actually walks in. Most shops need far fewer languages than they fear, and a well-made page in three languages beats a machine-translated page in fifteen.

And be careful about what you let a machine translate unreviewed. Marketing copy going slightly odd in translation costs you very little. An allergen list, a dosage instruction, a safety warning or a returns condition going slightly odd is a different category of problem, and it's the category where getting it wrong can hurt someone. Have a human who actually speaks the language read anything in that group before it goes live.

Two related points sit elsewhere on this page. If you stock products carrying a manufacturer's own code, as covered in the Digital Product Passport section, the page it opens is built by the manufacturer rather than by you, so the language it lands in is outside your control and worth checking on your own shelves. And language is only one way a landing page shuts people out. The accessibility section below covers the rest.

Are your QR codes accessible to disabled customers?

Probably not, and the code is only half of it. A QR code is a purely visual target. A blind shopper has no way to know one is on the shelf, no way to aim a camera at something they cannot see, and no way to tell your loyalty signup from your allergen list. Then, if they do get through, the page on the other end is usually the bigger failure.

Worth separating those two problems, because they have different fixes. One is finding and hitting the code. The other is whether the destination works once you land on it.

This has also stopped being purely a goodwill question. The European Accessibility Act, Directive (EU) 2019/882, has applied since 28 June 2025. It covers e-commerce websites and mobile apps, payment terminals and consumer-facing communications, and it reaches service providers based outside the EU that sell into it. So if you ship to customers in Europe, this is your problem regardless of which country your shop is in.

For the page itself the reference standard is WCAG 2.2, published as a W3C Recommendation on 5 October 2023 with 86 success criteria in total. Several of the nine it added are exactly the ones a QR landing page tends to fail. Target Size (Minimum) is about tap targets big enough to hit. Accessible Authentication says you should not force someone through a memory or puzzle test to log in. Redundant Entry says stop asking for the same detail twice.

That last cluster is worth dwelling on, because the standard pattern in retail is a code that lands on a promo page demanding an account, a captcha and a re-typed email before it gives up the discount. That page is hostile to plenty of people, and it fails a published standard while it does it.

What actually helps:

• Put codes in the same place every time. Consistent position on every shelf edge or every table means a returning customer with low vision learns where to look once instead of hunting each visit.
• Add NFC where it earns its keep. A tap needs no aim and no camera. Pairing a tag with the code at high-value spots like the payment point covers people a visual target never will.
• Keep the printed contrast honest. A code at low contrast on a busy background is harder for everyone and impossible for some. This is the same discipline that keeps scan rates up generally, so you are not spending anything extra.
• Test the destination with a screen reader. Ten minutes with VoiceOver or TalkBack on your own landing page will tell you more than any checklist. Then try it at 200 percent zoom.
• Make staff the guaranteed fallback. Any information a code gives out, someone behind the counter should be able to give out too. That single rule quietly covers most disabilities you have not specifically designed for.

And this pairs with the printed URL from the section above rather than replacing it. A URL someone can read aloud, type, or hand to a companion is genuinely useful. It just does not help the person who cannot see that there was anything to read in the first place.

How do you stop someone tampering with your QR codes?

Check them, physically, on a schedule. This is the one risk in this article that costs real money, and it is aimed at exactly the code you most want in your shop: the payment one.

The attack is crude and it works. Someone walks in, sticks their own QR sticker over yours, and walks out. Your customer scans, pays, and the money goes to them. You do not find out until you reconcile, and by then the sticker may already be gone. The Montgomery County Police Department describes this method plainly as "QR codes applied as stickers on top of the original QR code," and it is the single most common physical tampering method they flag.

Their detection advice is refreshingly low-tech, and it takes about two seconds per code. Run a fingernail across the code and feel for a change in thickness. Try lifting a corner and see whether anything separates from the surface underneath. A printed code is part of the sign. A stuck-on code is not.

What that means for a shop:

• Check your payment codes at open and close. Fingernail across, corner lifted. It belongs in the same routine as counting the float.
• Scan your own codes weekly. Not to check they work, but to check where they go. A tampered code still scans perfectly. That is the point of it.
• Laminate or frame the ones that carry money. A code under a rigid cover is much harder to paper over without it being obvious.
• Tell your staff what the real destination looks like. Whoever is at the till should know which merchant name is supposed to appear on the customer's phone, because they will see it over the counter dozens of times a day.
• Report it if it happens. Tell your acquirer or bank first, since the fraudulent account can be acted on, and file a police report.

None of this applies to your shelf-information codes in any serious way. Nobody is going to steal much by redirecting your sizing chart. Concentrate the checking on the codes where money moves, and do not let a payment code live on a loose sticker you would not notice being replaced.

How common is QR code fraud, really?

Less common than the headlines suggest, and harder to pin a number on than anyone selling you anti-fraud services will admit. Here's the honest version, straight from the police.

The Singapore Police Force publishes an Annual Scam and Cybercrime Brief, and the 2025 edition contains the first genuinely good news in years. Scam cases fell 27.6 per cent to 37,308, down from 51,501 in 2024. Losses fell 17.9 per cent to about $913.1 million, from about $1,112.4 million. Total scam and cybercrime cases dropped 24.8 per cent to 41,974. That's the first decline since the police began reporting scams as their own category.

Now the part that matters for your shop. There is no QR code scam category in that report. The top five by case count were e-commerce, phishing, job, investment and government officials impersonation scams. Phishing came second on volume with 6,264 cases, though only $39.9 million of the losses, which tells you it's a high-frequency, lower-value crime.

QR-based phishing, the thing people call quishing, sits inside that phishing bucket rather than standing on its own. So when someone quotes you a precise figure for QR code scams, ask where it came from, because the national statistics don't break it out. That isn't a Singapore quirk either. Most national crime statistics classify by what the scam did to you rather than by the technology that delivered it, so a QR code that led to a phishing page gets counted as phishing almost everywhere. Wherever you trade, the honest answer to "how big is the QR fraud problem" is usually that nobody counts it separately. What you can take from the data is the shape of the risk: phishing is common but individually small, and the trend across every category is finally downward.

None of which is a reason to skip the fingernail check. A sticker over your payment code is a direct hit on your takings rather than a scam against a member of the public, and it wouldn't show up in these numbers as a QR problem anyway. Two seconds at open and close still beats finding out at reconciliation.

What are you allowed to collect when someone scans?

Less than most retailers assume, and the loyalty signup from the list above is exactly where this bites. Getting a phone number at the till is easy. Being allowed to text it afterwards is a separate question with a separate answer.

The law you're under depends on where you trade. The principle behind it barely moves. Consent has to be something the customer actively did, and it has to be attached to the specific thing you're going to do with their number. The EU's General Data Protection Regulation states it about as plainly as a statute ever manages. Recital 32 says silence, pre-ticked boxes or inactivity do not constitute consent, and that consent needs a clear affirmative act giving a freely given, specific, informed and unambiguous indication of agreement. Whatever your own regulator is called, that sentence is a fair guide to what it will expect of you.

Here is how that plays out in one market, because a worked example lands better than a principle. Singapore's Do Not Call provisions sit inside the PDPA and cover marketing sent by voice call, SMS or fax to Singapore numbers. The Personal Data Protection Commission sets out the rule plainly: unless you have the subscriber's clear and unambiguous consent in written or other accessible form, you have to check the DNC Registry before each campaign. Consent, properly obtained, is what removes the checking obligation. Absence of a complaint is not.

The penalties are sized to be noticed. A breach of the DNC provisions can draw a financial penalty of up to 10 percent of an organisation's annual Singapore turnover where that turnover exceeds S$10 million, or up to S$1 million, whichever is higher.

Swap in your own regulator and the numbers change while the counter does not. Here is what it means at the till:

• Joining loyalty is not consenting to marketing. Make them two separate opt-ins on the form behind the code. Bundling them is the most common way small retailers get this wrong.
• Don't pre-tick the box. Consent has to be clear and unambiguous, and a box the customer never touched fails that on both counts.
• Keep the record. Store what they agreed to and when. If it's ever questioned, the consent record is the whole defence.
• Collect only what the purpose needs. A stamp card doesn't need a birthday, a full address and an NRIC number. Every extra field is data you now have to protect and justify.
• Say what it's for at the point of collection. One line above the form beats a policy link nobody opens.

Two more things worth knowing. Review collection is lower risk because you're sending someone to Google rather than capturing their details, so keep it that way and don't quietly bolt a data-capture form onto the review link. And if you operate across the region, this is Singapore law: Malaysia, Indonesia and the Philippines each run their own regime, so a consent flow built for one market doesn't automatically clear you in the next.

How do you tell if your retail QR codes are working?

You measure against your own baseline, because the published benchmarks are close to worthless. Start there, because it saves you from the first mistake most retailers make.

Search for retail QR scan rates and you will find confident numbers everywhere. Two to five percent of product interactions. Ten to twenty percent lift on conversion. Look at who publishes them and it is almost always a company selling QR code generators or QR analytics. That does not make the numbers invented, but it does mean nobody neutral has checked them, and the incentive runs one direction. Treat an industry benchmark as a sales aid rather than a target.

Your own numbers are more useful anyway, and you can get them without buying anything.

• Use a dynamic code for anything you want to measure. A static code encodes the destination directly and cannot count anything. A dynamic one points at a redirect you control, which is what makes scans countable in the first place. Our dynamic versus static guide covers the trade-off, including what happens if the redirect service disappears.
• Give every placement its own code. One code on the shelf talker, a different one on the window, a third on the receipt. Identical destination, separate codes. Otherwise you learn that people scanned and nothing about where they were standing when they did.
• Measure the action, not the scan. A scan is somebody pointing a camera. The thing you actually care about is what happened next, so put the target on the far side: reviews left, sign-ups, the voucher redeemed at the till.
• Run it long enough to mean something. A week of foot traffic in one shop is a small sample and weekdays do not look like weekends. Compare a full month against the next full month rather than reading Tuesday as a trend.

One thing that costs nothing and beats any dashboard. Stand near the code for twenty minutes and watch. You will see whether people notice it, whether they can reach it, whether the glare off the window kills it at two in the afternoon. Analytics tell you that a placement is underperforming. Watching tells you why, and it is usually something physical you can fix that day.

Keep the privacy limits in mind while you do this. Counting scans and destinations is ordinary analytics. The moment you start collecting personal details behind the code, the rules covered further up apply, and consent for a voucher is not consent to market to somebody forever.

Can a QR code replace the paper receipt?

Partly. A QR code can hand the customer a digital receipt instead of a printed one, and plenty of shoppers would rather have that. But how you do it depends on your till, and it's worth being clear about what a free static code can and can't do here.

The version most people picture is a code on the card terminal or customer display after payment. The shopper scans it and their receipt opens on their phone. That code is different for every sale, so it has to come from your point-of-sale system, not a generator like this one. Most modern POS providers offer it as a setting. If yours does, it's usually the easiest switch you'll make all year.

A static code still has a job at the counter, though. It can link to a sign-up page where customers choose to get receipts by email, to your returns and warranty policy, or to a page explaining how to request a copy of a past receipt. Those don't change per sale, which is exactly what static codes are good at. If you're weighing the two, our static vs dynamic QR code guide covers the trade-off.

Why would shoppers want a paper-free receipt?

Convenience, mostly. Paper receipts fade, get lost and never turn up when you need to return something. But there's a health angle too, and it's the one that tends to surprise people.

Most till receipts are printed on thermal paper, and thermal paper has often been coated with bisphenol A, better known as BPA, as the chemical that makes the print appear. A 2014 study in PLOS ONE, by Hormann and colleagues at the University of Missouri, including Frederick vom Saal, measured about 20 milligrams of BPA per gram of receipt paper. The researchers had volunteers use a common hand sanitiser, hold a receipt, then eat French fries with their hands. Some hand sanitisers contain ingredients that the authors note can raise skin absorption of chemicals like BPA by up to 100 times. Blood levels of active BPA rose to an average peak of about 7 nanograms per millilitre within 90 minutes.

That's one small study built around a worst-case sequence, so don't read it as proof that every receipt is harmful. But regulators have acted on the same concern. Since 2 January 2020, the European Union has banned thermal paper containing 0.02 percent or more BPA by weight, under Commission Regulation (EU) 2016/2235, as France's national institute for industrial environment and risks, INERIS, summarises. Outside the EU the rules vary a lot, and some replacement chemicals are similar enough that the debate hasn't gone away. Offering a digital receipt sidesteps the question for customers who'd rather not handle paper at all, and for your staff, who handle far more of it than anyone.

What should you check before going paperless?

• Keep paper as an option. Not everyone has a phone to hand, a data connection or the patience to scan. The section above on customers who can't or won't scan applies here in full.
• Check your local rules. In some countries a customer can ask for a printed receipt, and tax invoices for business buyers often have their own format requirements. Ask your accountant or POS provider what applies where you trade.
• Don't turn receipts into a data grab. If the digital receipt asks for an email address, say what you'll use it for and don't bundle in marketing consent by default. The earlier section on what you're allowed to collect covers this.
• Make returns work without the paper. If staff can't look up a digital receipt at the returns desk, customers will keep asking for paper, and they'll be right to.

If your QR codes at the till already handle payments, our QR code payment guide covers how the payment side works so the receipt step fits around it.

Do you have to pay for retail QR codes?

No, not for most of what a shop needs.

Static codes are free to generate and free forever, because there is no service in the middle. You can make every shelf code, WiFi code and review code on this site at no cost, with no account. Our free QR generator does it in the browser.

You pay in three situations. Dynamic codes with tracking need a subscription. Payment codes come through your bank or payment provider and carry whatever fees they charge on transactions. And GS1-issued product codes, the kind tied to a GTIN for point-of-sale scanning, come from GS1 membership, which is a separate thing from a marketing QR code entirely. Do not confuse the two: a free generator cannot produce a code that scans as a product at a till.

For a shop fitting out its first codes, the honest budget is zero. If you already run a small business more broadly, our small business QR guide covers the wider setup.

What else do people ask about QR codes in retail?

What is the best way to use QR codes in a retail store?

Shelf-edge product information is the highest value starting point, because it answers the question a shopper is already asking while they hold the product. Link the code to ingredients, sizing, care instructions, or reviews. Payment codes and loyalty signup come next, since both remove friction at the moment a customer has already decided to buy.

Do retailers have to accept QR codes at checkout by 2027?

That is the goal of the GS1 Sunrise 2027 initiative, which is a global move from traditional 1D barcodes to 2D codes like QR. GS1 US says retailers need Sunrise-capable optical scanners that can read 2D barcodes and pull the GTIN at point of sale. It is an industry milestone rather than a law, and GS1 notes not every 2D capability has to be in place by that date.

Should a retail store use static or dynamic QR codes?

Use static codes for anything permanent, such as WiFi access, your review link, or a payment display. They are free and never expire. Use dynamic codes for anything you will change, like a seasonal promotion or a campaign you want to track, and accept that those usually need a paid subscription.

How big should a QR code be on a shelf label?

Around 2cm square works for shelf labels and product tags where a shopper is standing close. The working rule is that scan distance is roughly ten times the width of the code, so a 2cm code scans comfortably from about 20cm. Window and poster codes need to be much larger.

Why do QR codes in shops sometimes fail to scan?

The usual causes are physical rather than technical. Codes printed too small for the viewing distance, glossy laminate or glass throwing glare, poor contrast such as light grey on white, codes placed too low or behind a display, or damage from handling. Print a test copy and scan it in the actual spot before you commit to a print run.

Make a free QR code for your shop →

Sources: Hormann A. M., vom Saal F. S., Nagel S. C. et al., Holding thermal receipt paper and eating food after using hand sanitizer results in high serum bioactive and urine total levels of bisphenol A (BPA), PLOS ONE 9(10), e110509, 2014. Commission Regulation (EU) 2016/2235 amending Annex XVII to REACH as regards bisphenol A in thermal paper, applicable from 2 January 2020, as summarised by INERIS. GS1, 2D Barcodes at Retail Point-of-Sale Implementation Guideline, ref.gs1.org, on a single QR code carrying a GS1 Digital Link URI being consumer scannable with a default camera app while a software-enabled imaging scanner extracts the GTIN at point of sale, on the end-2027 goal of POS scanning globally reading and processing the GTIN from both linear and 2D barcodes, on software and possible equipment upgrades where a scanner is not imager capable, and on the rule that until 90 percent of POS scanning solutions can use GS1-compliant 2D barcodes and at minimum capture the GTIN, products carrying a retail 2D barcode must be accompanied by a POS linear barcode. GS1 US, Sunrise 2027, gs1us.org, on the transition to 2D barcodes at retail point of sale, on the crawl, walk, run readiness framework for retailers, and on its 2025 consumer survey finding 79 percent prefer products with a scannable QR code offering extra information, 77 percent factoring product information into purchase decisions and 62 percent saying they would pay more for it. European Commission, Implementing the Ecodesign for Sustainable Products Regulation, green-forum.ec.europa.eu, on the ESPR entering into force on 18 July 2024 and the Digital Product Passport work programme. Payments Network Malaysia (PayNet), press release on 2025 transaction volumes, paynet.my. NETS, announcement of the SGQR+ islandwide rollout, 7 November 2024, nets.com.sg, on acceptance points, schemes per merchant and single-acquirer consolidation. Montgomery County Police Department, Maryland, Fake QR Codes, montgomerycountymd.gov, on sticker-over-sticker tampering and physical detection checks. Personal Data Protection Commission Singapore, Do Not Call Registry and Your Business, pdpc.gov.sg, on the consent and checking obligations and the financial penalties. Centre for Research on Successful Ageing (ROSA), Singapore Management University, Digital Literacy Among Older Adults in Singapore research brief, drawing on IMDA survey data. Infocomm Media Development Authority, Digital Readiness and the Seniors Go Digital programme, imda.gov.sg. Bank of Thailand, Cross-border Payment Linkages, bot.or.th, on the ten linked countries and regions, the scheme names on each side, the Lao PDR launch across April and June 2024, and the merchant-presented versus consumer-presented mechanisms. Singapore and Malaysia launched the NETS QR to DuitNow QR linkage on 31 March 2023, under the Memorandum of Understanding on Regional Payment Connectivity signed in November 2022 by the central banks of Indonesia, Malaysia, the Philippines, Singapore and Thailand, with Vietnam joining in August 2023. Industry timelines are set by those bodies and can move, so check the official pages before you plan a rollout. European Commission, Digital Product Passport for Batteries, single-market-economy.ec.europa.eu, on the battery passport becoming mandatory on 18 February 2027 for relevant categories placed on the EU market, linked to the battery by QR code, covering electric vehicle, e-bike, e-moped, e-scooter, home storage and industrial batteries. Regulation (EU) 2023/1542 (Batteries Regulation), Annex VI Part C and Article 77, on all batteries carrying a QR code from 18 February 2027 and on the passport for LMT batteries, industrial batteries above 2 kWh and electric vehicle batteries. Which wallets work in a given shop depends on your acquirer and the visitor's bank, so confirm coverage with your acquirer rather than assuming.