QR codes on flyers, signs and vans: track the scans and keep them safe

Decide what happens after the scan

A QR code is a route to a destination, not a marketing strategy. Choose the action first: read the relevant service details, view opening information, make an enquiry or book the correctly described appointment. Sending every printed item to the homepage can make the customer find the offer again. Keep a visible, readable web address beside the code where practical. It gives people an alternative when scanning is difficult and helps them recognise the intended business destination. Match the printed promise to the page they will actually reach.

Keep readingSave the source with every enquiry

Choose who controls the destination

A code can contain the final URL, or a redirect can sit between the code and the final page. A redirect can make a long-lived printed placement easier to maintain, but it also adds a service, account or domain that must keep working. Before using a third-party dynamic-code service, check who owns the account, what happens when a plan changes and whether the business can keep the destination available. An owned redirect also needs maintenance. Document the full path rather than assuming a code will work forever because it scanned once.

Create a placement sheet with consistent tags

Google Analytics documents campaign parameters including utm_source, utm_medium and utm_campaign. Decide a naming convention before generating the artwork, then keep the exact final URL with the print file.

These are illustrative naming choices, not reserved Analytics values. Keep spelling and capitalisation consistent. Use a separate placement or content identifier when useful, and never put customer names, email addresses or other personal details into campaign parameters.

• Reception flyer: source reception, medium print, campaign a clearly named offer or service.
• Vehicle graphic: source vehicle, medium print, campaign the relevant ongoing service.
• Event handout: source the specific event, medium print, campaign the event activity.

Test the actual print, not only the design file

Print a proof at its intended size and test it using more than one available phone and the conditions in which customers will see it. Check scanning distance, lighting, contrast, quiet space around the code and any reflective or curved surface. Follow every redirect and confirm the destination, campaign parameters, mobile layout, form and confirmation. A code that scans but lands on an expired offer has failed the customer task. Have somebody outside the design process perform the test and record the exact artwork version approved.

Protect the physical placement

Australian cyber-security guidance identifies QR-code phishing as a way of directing people to a malicious destination. For public-facing signs, include a routine check for a sticker placed over the genuine code or an altered destination. Give staff a clear way to report a problem. Do not ask customers to trust a QR code merely because it carries your logo. A recognisable domain and a consistent page help them assess where they have landed. Retire or cover printed codes that can no longer lead to an appropriate destination.

Keep readingMake the page keep the printed promise

Measure the useful next step

Compare tagged visits with completed enquiries or other clearly defined actions, while allowing for consent settings, blocked measurement and people who type the address instead. A scan or visit is not a unique person, a qualified enquiry or a sale. For a worked placement review, compare the reception flyer and event handout over a stated period using the same enquiry definition. If one produces visits but little useful action, inspect the offer and destination before replacing the QR artwork. Keep the interpretation tied to the data you actually have.