Playbooks
QR Codes in Physical Retail: What's Actually Working in 2026
QR codes did not fade after the pandemic — adoption kept growing. An estimated 99.5 million US smartphone users scanned a QR code in 2025, projected to reach 102.6 million in 2026, and 93% of marketers report increasing QR code usage in the past year. Retail accounts for roughly 28% of all scans, mostly product information, loyalty programs, and promotions, and 62% of retailers running QR campaigns report a direct sales uplift. The one real headwind is security: "quishing" (QR phishing) grew roughly 5x in 2025, making retail's high-volume, many-location QR deployments an attractive target.
Last updated Aug 21 · 18 min read
Did QR codes survive past the pandemic, or was it a fad?
The pandemic-era jump was real and dramatic: US QR code usage went from 35% in September 2020 to 83% by April 2021, and at the time, 59% of shoppers said they expected to keep using QR codes permanently (eMarketer). That expectation appears to have held: 2025-2026 data shows continued growth, not decline. 93% of marketers increased QR code usage in the past 12 months, and 86% plan to increase it further (QR Code Chimp). Restaurant and hospitality adoption sits at roughly 75% (Wave Connect).
The global QR code market itself reflects this trajectory: estimated at $13.04 billion in 2025, projected to reach $33.14 billion by 2030 at a 20.5% CAGR (Scanova). That's not the shape of a fading pandemic-era workaround — it's the shape of a mechanism that found a permanent place in retail and hospitality operations.
What retail QR scans are actually used for
Scale of usage. An estimated 99.5 million US smartphone users scanned a QR code in 2025, projected to reach 102.6 million in 2026, and 72% of consumers report scanning one in the past month (Scanova; QR Code Chimp).
What's actually behind the scan. 45% of shoppers report using a QR code specifically to get product information while in-store, and retail as a category accounts for roughly 28% of all scans, spanning product info, loyalty programs, and promotions (Scanova).
Does it actually move sales? A 2025 GDA survey found 62% of retailers running QR campaigns saw a direct sales uplift, with discount offers, product videos, and personalized offers identified as the most effective formats (Scanova).
How does that compare to other channels? Cited figures put QR campaign click-through rates at 3.5-4.3%, outperforming email (roughly 2.5%) and display ads (under 0.5%) (Scanova). If those figures generalize to your specific vertical and audience, QR is a genuinely higher-engagement channel than either of those comparisons — though as with any cross-channel benchmark, actual performance depends heavily on placement, offer, and audience, so treat this as a directional comparison rather than a guarantee.
Restaurants and hospitality: menus, ordering, and payment
The restaurant QR menu became the most visible consumer-facing use case during the pandemic, and it didn't disappear once dine-in service returned to normal.
Adoption held. Roughly 75% of restaurants worldwide still use QR codes for digital menus (menucardstudio; Supercode).
But the use case evolved beyond "just a menu link." Modern implementations increasingly bundle full scan-order-pay functionality — a diner scans, orders, and pays entirely from their phone with no server involvement, aimed at faster table turns and automatic payment collection rather than replacing the printed menu one-for-one (Supercode; Umami QR).
Beyond the table. Restaurants and retailers are extending the same mechanism onto packaging, receipts, and takeaway bags — linking to reorder pages, loyalty programs, feedback forms, or gift-card purchase pages, typically placed near checkout or directly on takeaway packaging (Supercode; ez-qr.com).
The security problem: quishing
The one real headwind against QR adoption isn't consumer fatigue — it's a genuine, fast-growing security threat.
What "quishing" is. Quishing (QR-code phishing) is the use of malicious QR codes to route scanners to credential-harvesting or malware sites, exploiting the fact that a human can't visually distinguish a legitimate QR code from a malicious one before scanning it (Uniqode).
It's growing fast. Multiple security vendors report quishing grew roughly 5x in 2025, and the Anti-Phishing Working Group (APWG) documented a 400% increase heading into 2025 (Uniqode; Keepnet Labs).
Why retail specifically is a bigger target. Security researchers point to retail's high-volume QR deployments across many physical locations as creating an unusually large number of attack points — a malicious sticker placed over a legitimate parking-payment or menu QR code is a well-documented, low-cost attack vector. One analysis also found retail staff had the highest miss-rate for spotting suspicious codes among the groups studied (Acronis).
What this means practically for a retailer or restaurant. The fix is not "stop using QR codes" — the adoption and sales-lift data above make that a poor trade-off. It's operational: use tamper-evident placement, periodically physically inspect deployed codes for stickers or overlays, and prefer QR generation that doesn't route through a third-party redirect a bad actor could intercept or replace.
India's QR ecosystem: a fundamentally different use case
India's QR code usage is dominated by a materially different mechanism than the US/Europe menu-and-marketing pattern covered above: UPI (Unified Payments Interface) payment QR codes.
Scale. UPI had roughly 554 million registered users and over 65 million merchants accepting it as of 2026, with the number of deployed QR codes reaching roughly 678 million in the first half of 2025 — one of the largest QR-based merchant payment networks in the world (Meetanshi).
Transaction volume. India's UPI system processed 228.3 billion transactions in 2025, worth roughly ₹299.7 lakh crore (on the order of $3.5 trillion) (Meetanshi). That figure covers all UPI transactions — QR-code scans, UPI-ID entry, and app-to-app payments together — the source reviewed doesn't isolate the QR-initiated share specifically, so treat "how much of that $3.5T flowed through an actual QR scan versus another UPI entry method" as evidence not sufficiently verified rather than a precise breakout.
Why this matters for the "physical retail QR use case" conversation. In the US/Europe framing, a QR code is primarily a marketing or information channel — a way to get a customer to a menu, a product page, or a loyalty signup. In India, the dominant retail QR use case is the payment transaction itself: a shopkeeper displays a UPI QR code at the counter, and the customer pays by scanning it, no card machine required. Any retailer or agency working across both markets needs to recognize these are functionally different jobs for the same underlying technology, not one universal "QR code marketing" playbook.
Practical examples
Real, sourced example — the 2025 GDA retailer survey. A 2025 survey by the GDA found that of retailers who ran a QR code campaign, 62% reported a direct sales uplift, with the most effective formats being discount offers, product videos, and personalized offers rather than generic "scan for more info" placements (Scanova).
Real, sourced example — restaurant scan-order-pay. Modern restaurant implementations documented by Supercode and Umami QR go well beyond a static menu link: a diner scans a table QR code, browses the full menu, places an order, and pays — all without a server ever approaching the table — explicitly framed around faster table turnover and automatic payment collection rather than just digitizing a paper menu (Supercode; Umami QR).
Illustrative example (hypothetical, clearly labeled) — a small retailer's packaging QR strategy. A boutique skincare brand puts a QR code on its product packaging linking to a how-to-use video and an authenticity-verification page, and a second QR code on the receipt linking to a review-request page. This composite scenario reflects the documented pattern of packaging and receipt-based QR use (reorder links, loyalty, feedback, review requests) rather than describing a specific named brand.
Data and evidence
– 99.5 million US smartphone users scanned a QR code in 2025, projected to reach 102.6 million in 2026; 72% scanned one in the past month (Scanova; QR Code Chimp).
– 45% of shoppers used a QR code for in-store product information; retail is roughly 28% of all scans (Scanova).
– 93% of marketers increased QR usage in the past 12 months; 86% plan to increase it further; restaurant/hospitality adoption is roughly 75% (QR Code Chimp; Wave Connect).
– 62% of retailers running QR campaigns saw a direct sales uplift (2025 GDA survey) (Scanova).
– QR campaign click-through rates: 3.5-4.3%, versus roughly 2.5% for email and under 0.5% for display ads (Scanova).
– Global QR code market: $13.04 billion in 2025, projected to reach $33.14 billion by 2030 (20.5% CAGR) (Scanova).
– Quishing grew roughly 5x in 2025; APWG documented a 400% increase heading into 2025 (Uniqode; Keepnet Labs).
– India: ~678 million deployed UPI QR codes (H1 2025), ~65 million registered merchants, 554 million registered users, and 228.3 billion total UPI transactions in 2025 worth roughly ₹299.7 lakh crore (~$3.5 trillion) — note this transaction total covers all UPI payment methods, not QR scans specifically (Meetanshi).
– Pandemic-era jump: US QR usage rose from 35% (Sept 2020) to 83% (April 2021); 59% of shoppers expected to keep using QR codes permanently (eMarketer).
– On precise attribution of sales lift specifically to the QR mechanism versus the underlying offer/discount driving it: evidence not sufficiently verified — the GDA survey reports uplift associated with QR campaigns, but doesn't isolate the QR code itself from the promotional offer it delivered.
Comparisons
Static vs. dynamic QR codes for retail. A static QR code encodes its destination directly and permanently — it never expires and needs no ongoing service. A dynamic QR code routes through a redirect service, letting the destination be changed after printing and often adding scan analytics, at the cost of depending on that service staying operational (and, in many cases, on an ongoing subscription). For anything permanent — packaging, a menu that rarely changes, a payment QR — static is the more durable choice; dynamic earns its cost when you specifically need to change the destination after print or need scan-level analytics.
QR code vs. NFC tag for retail. Both let a customer trigger a digital action by physically approaching a point in-store, but a QR code only needs a printed image and any phone camera, while NFC requires an NFC-capable device held close to a physical tag. QR's near-zero marginal cost per deployment (just print another sticker) is a large part of why it dominates high-volume, many-location retail use over NFC.
QR code campaigns vs. email vs. display ads (click-through rate). Per the Scanova-cited figures above, QR sits meaningfully above both channels (3.5-4.3% vs. ~2.5% for email and <0.5% for display) — though comparing click-through rate across fundamentally different channels (a physical scan vs. a digital click) should be read as directional evidence of engagement, not a fully apples-to-apples metric.
Real-world use cases
– A restaurant replacing a static printed menu with a scan-order-pay system — faster table turns, no server needed for ordering or payment collection (Supercode).
– A retailer adding a QR code to product packaging linking to an authenticity check or how-to video, addressing the 45%-of-shoppers-want-product-info statistic directly at the point of purchase.
– A small business in India displaying a UPI QR code at checkout — no card machine investment needed, tapping into an ecosystem that processed roughly $3.5 trillion across all UPI payment methods in 2025.
– A marketer running a discount-offer QR campaign on packaging or in-store signage, aligned with the GDA survey's finding that discount offers were among the most effective formats for driving measurable sales uplift.
Common mistakes
– Treating a QR code as a generic "link" without a specific, high-value destination. The GDA survey data suggests generic info dumps underperform discount offers, product videos, and personalized offers specifically.
– Using a dynamic/redirect-based QR service for something meant to be permanent (packaging, signage), creating dependency on a third-party service that could raise prices, add tracking, or shut down.
– No physical inspection routine for deployed QR codes, leaving them vulnerable to the sticker-overlay quishing attack documented above, especially given retail staff's documented higher miss-rate for spotting tampered codes.
– Assuming "QR codes are a pandemic fad" and deprioritizing them, despite adoption data showing continued growth (93% of marketers increasing usage, 86% planning further increases) rather than decline.
– Shrinking the printed code below reliable scan size, or using low-contrast colors, both of which measurably hurt scan success rates regardless of how good the destination content is.
– Applying the US/Europe "marketing QR" mental model to a market like India, where the dominant use case is a payment transaction, not a marketing touchpoint — the operational and security considerations differ meaningfully.
Best practices
– Point QR codes at a specific, high-value destination (a discount, a product video, a personalized offer) rather than a generic landing page — this is the pattern the 2025 GDA survey found most effective.
– Use a static QR code for anything permanent (packaging, signage, payment) so it never expires and doesn't depend on an ongoing third-party service.
– Add a short prompt next to the code — "Scan to pay," "Scan for menu" — since this measurably lifts scan rates versus an unlabeled code.
– Keep contrast high (dark code on light background) and size the printed code appropriately for its viewing distance — undersized or low-contrast codes fail to scan reliably regardless of destination quality.
– Physically inspect deployed QR codes periodically for stickers or overlays, especially in high-traffic, many-location retail settings where quishing attacks concentrate.
– Test every deployed code with at least two different phones before printing at scale.
– If operating in India or serving Indian customers, treat the UPI payment QR use case as operationally distinct from marketing/menu QR use cases — different risk profile, different customer expectation, different mechanics.
Key takeaways
– QR code adoption grew, not faded, after the pandemic — 93% of marketers increased usage in the past year, and the global market is projected to nearly triple by 2030.
– In-store QR use is dominated by product information, loyalty, and promotions (28% of scans are retail), and 62% of retailers running campaigns report a direct sales uplift, especially with discount offers, product videos, and personalized offers.
– Restaurant QR menus held at roughly 75% adoption and have evolved toward full scan-order-pay functionality, not just static menu links.
– Quishing (QR phishing) is a real, fast-growing threat — roughly 5x growth in 2025 — and retail's many-location, high-volume deployments make it a disproportionate target; physical tamper-inspection is a real operational need now, not optional caution.
– India's QR ecosystem is fundamentally different: it's dominated by UPI payment codes (roughly 678 million deployed codes, inside a UPI system processing ~$3.5 trillion across all payment methods in 2025), not marketing links — don't apply the US/Europe playbook there unmodified.
– Use static QR codes for anything permanent, and always test on two devices before printing at scale.
Relevant tools.scult.in resources
The QR Code Generator (with UPI) creates permanent, static QR codes for URLs, plain text, WiFi credentials, or UPI payment addresses entirely in your browser — no tracking redirect, no expiry, and no dependency on a service that might raise prices or shut down later, which matters directly given the dynamic-QR risk described above. For campaign copy and offer ideas to put behind your next QR placement, the E-commerce & Product prompt library has relevant starting points.
If QR is one piece of a broader in-store or local marketing push — packaging, signage, loyalty, and getting found in local search — that kind of on-the-ground marketing collateral strategy is exactly the territory SCULT's local SEO service works in alongside tools like this one.
Frequently asked questions
Why do stores use QR codes now?
Primarily for product information, loyalty programs, promotions, and (in restaurants) menus and ordering — 45% of shoppers report using one for in-store product info specifically (Scanova).
Are QR codes still popular in 2026?
Yes — 93% of marketers increased usage in the past 12 months and 86% plan to increase it further, with continued market growth projected through 2030 (QR Code Chimp; Scanova).
What happened to QR code menus after COVID?
They largely stayed — roughly 75% of restaurants worldwide still use QR codes for digital menus, now often paired with full order-and-pay functionality (menucardstudio).
Are QR codes safe to scan in stores?
Generally yes, but quishing (malicious QR phishing) is a real and growing threat — check for signs of tampering like stickers placed over an existing code before scanning anything in a public setting.
Do QR code campaigns actually increase sales?
Evidence suggests yes for many retailers — 62% of retailers running QR campaigns in a 2025 survey reported a direct sales uplift (Scanova).
What can a QR code actually contain?
Commonly a website URL, plain text, WiFi credentials, or a payment address (like a UPI VPA) — the destination is fully determined by what the generator encoded into it.
Do QR codes expire?
A static QR code, which encodes the destination directly, does not expire. A dynamic QR code that redirects through a third-party service can stop working if that service shuts down or the subscription lapses.
How big is the QR code market?
Estimated at $13.04 billion in 2025, projected to reach $33.14 billion by 2030 (Scanova).
What's the difference between a QR code for marketing and a QR code for payment?
A marketing QR code links to information or an offer; a payment QR code (like India's UPI codes) directly encodes payment details so a scan completes a transaction.
Do customers actually trust and use QR codes, or is it just a novelty?
Usage data (99.5-102.6 million US scanners, 72% scanning in the past month) suggests it's a routine, trusted behavior for a large share of consumers, not a novelty.
What share of scans come from retail specifically?
Roughly 28% of all QR scans, spanning product info, loyalty, and promotions (Scanova).
How do QR click-through rates compare to email and display ads?
3.5-4.3% for QR campaigns versus roughly 2.5% for email and under 0.5% for display ads, per cited figures — a directional comparison, not a guaranteed outcome for any specific campaign (Scanova).
What QR campaign formats actually perform best in retail?
Discount offers, product videos, and personalized offers, per the 2025 GDA retailer survey (Scanova).
What was the pandemic-era adoption jump, and did it hold?
US usage rose from 35% (Sept 2020) to 83% (April 2021); subsequent 2025-2026 data (continued growth, high adoption, high satisfaction figures) suggests the jump largely held rather than reverting (eMarketer).
What is quishing?
QR-code phishing — malicious codes that route a scanner to a credential-harvesting or malware site (Uniqode).
Why is retail a particularly attractive target for quishing?
High-volume QR deployments spread across many physical locations create many low-cost attack points, and retail staff reportedly had the highest miss-rate for spotting suspicious codes in one analysis (Acronis).
How fast is quishing growing?
Roughly 5x in 2025 by some vendor estimates, with the APWG documenting a 400% increase heading into 2025 (Uniqode; Keepnet Labs).
What makes India's QR use case different from the US/Europe model?
In India, the dominant use is UPI payment QR codes at the point of sale, not a marketing/informational link — a functionally different job for the same underlying technology.
How big is India's UPI QR ecosystem?
Roughly 678 million deployed QR codes and 65 million merchants as of 2025-2026, inside a UPI system that processed 228.3 billion total transactions worth roughly $3.5 trillion in 2025 (across all UPI payment methods, not QR scans alone) (Meetanshi).
Do restaurants still use QR codes just for the menu, or has the use case expanded?
It's expanded — modern implementations frequently bundle full ordering and payment, not just a static menu link (Supercode).
How do I create a QR code for my store?
Use a QR code generator, choose the content type (URL, text, WiFi, or payment address), and download it as a PNG or SVG for print.
How do I add a QR code to product packaging?
Design it into the packaging artwork at a size that scans reliably at typical handling distance, and link it to something specific — an authenticity check, a how-to video, or a reorder page.
How do I set up scan-to-pay at a restaurant table?
Deploy a table-specific QR code linking to a digital menu with integrated ordering and payment, following the scan-order-pay pattern documented above.
How do I make sure my printed QR code will actually scan reliably?
Keep contrast high (dark code, light background), size it appropriately for viewing distance (roughly 2×2 cm minimum for close-range print, larger for anything read from further away), and test with two different phones before printing at scale.
How do I protect my in-store QR codes from tampering?
Physically inspect deployed codes periodically for stickers or overlays, and consider placement that makes tampering visually obvious.
How do I choose between a static and dynamic QR code?
Use static for anything permanent (packaging, fixed signage, payment); consider dynamic only if you specifically need to change the destination after printing or need scan-level analytics, and are comfortable depending on that service continuing to operate.
How do I measure whether my QR campaign is actually working?
Track redemptions or conversions on the destination page/offer, since that ties the scan to an actual business outcome rather than just counting scans.
How do I choose what my QR code should link to for the best results?
Favor discount offers, product videos, or personalized offers over generic information pages, per the GDA survey's findings on what actually drives sales uplift.
How do I add a short prompt to improve scan rates?
Place text like "Scan to pay" or "Scan for menu" directly next to the code — documented to measurably lift scan rates over an unlabeled code.
How do I set up a UPI QR code for my business in India?
Generate a QR encoding your UPI payment address (VPA), display it at the counter, and confirm it scans correctly with at least one common payment app before relying on it.
How should QR strategy differ between a single-location boutique and a multi-location chain?
A chain needs a systematic tamper-inspection routine and consistent placement standards across locations, since the attack surface for quishing scales directly with the number of deployed codes.
Is there a meaningful difference in effectiveness between QR codes on packaging versus in-store signage?
Not independently benchmarked in the sources reviewed — evidence not sufficiently verified; general best practices (specific destination, high contrast, appropriate size) apply to both.
Does QR code error-correction level matter for retail deployments?
Yes in principle — higher error correction tolerates more damage or dirt on a printed code before it fails to scan, which matters more for anything exposed to wear (stickers, packaging) than for a clean digital display.
How does the effectiveness of scan-order-pay compare to traditional table service in measurable terms (table turn time, order accuracy)?
Not independently benchmarked with hard numbers in the sources reviewed — evidence not sufficiently verified beyond the general framing that faster table turns and automated payment collection are the intended benefits.
Is the 62% sales-uplift figure from the GDA survey representative across all retail verticals, or concentrated in specific categories?
Not broken out by vertical in the source reviewed — evidence not sufficiently verified at that level of granularity.
QR code vs. NFC tag for retail — which is better?
QR needs only a printed image and any phone camera, at near-zero marginal cost per deployment; NFC needs an NFC-capable device and a physical tag, generally at higher per-unit cost — QR's cost and universality advantage is largely why it dominates high-volume retail use.
Static vs. dynamic QR code — which should a retailer use?
Static for permanent, low-maintenance deployments (packaging, fixed signage, payment); dynamic only when you specifically need post-print destination changes or scan analytics, accepting the dependency on the redirect service.
QR code campaigns vs. email marketing — which converts better?
Cited click-through figures favor QR (3.5-4.3% vs. ~2.5%), though the two channels reach customers in very different contexts (physical, in-the-moment vs. digital inbox), so "better" depends on the specific use case rather than a universal ranking.
QR code vs. display advertising — which has better engagement?
Cited figures show QR substantially outperforming display (3.5-4.3% vs. under 0.5%), consistent with QR's advantage of targeting an already-engaged, physically-present customer rather than a passive ad viewer.
US/Europe marketing-style QR use vs. India's UPI payment-style QR use — which model is "ahead"?
Neither — they're solving different problems (marketing/information delivery vs. payment infrastructure) at different points of massive respective scale; comparing them as a maturity ranking misreads what each is actually for.
Customers aren't scanning our in-store QR codes — what's usually wrong?
Check placement (is it visible and reachable), size/contrast (is it actually easy to scan), and whether there's a clear prompt telling the customer what scanning gets them — unlabeled or poorly placed codes underperform even with a good destination.
We suspect a QR code in our store was tampered with — what do we do?
Remove and replace it immediately, physically inspect nearby codes for the same pattern, and treat it as a security incident worth documenting given the sharp rise in quishing attacks.
Our QR code campaign had scans but no conversions — what's the likely cause?
The destination itself is the most common culprit — generic information pages underperform discount offers, product videos, and personalized offers per the GDA survey's findings.
Our dynamic QR code service raised prices or shut down, and now our printed codes are dead.
This is the specific risk of using a redirect-dependent dynamic QR for something meant to be permanent — for future deployments, use a static QR code for anything you can't easily reprint.
We're worried about quishing but don't want to abandon QR codes entirely — what's a reasonable middle ground?
Keep using QR codes (the adoption and sales-lift data support that), but add a physical tamper-inspection routine and prefer generation methods that don't rely on a third-party redirect a bad actor could intercept.
Should I pay for a QR code generator with tracking/analytics, or use a free static generator?
Depends on whether you need to change the destination after print or need scan-level analytics; for permanent packaging or signage, a free static generator with no ongoing dependency is often the more durable choice.
Is it worth investing in a full scan-order-pay system for my restaurant, or is a simple menu QR enough?
Depends on your priority — a simple menu QR covers the 75%-adoption baseline use case; full scan-order-pay is worth the added investment specifically if faster table turns and reduced staffing need are meaningful priorities for your operation.
Should a small retailer invest in QR-based loyalty/packaging campaigns given the security risk?
The adoption and sales-uplift data suggest yes, provided basic tamper-inspection practices are followed — abandoning QR entirely over quishing risk would mean giving up a channel with documented above-benchmark engagement.
Is dynamic QR code software worth the subscription cost for a growing retail chain?
Worth evaluating specifically if you need centralized destination updates across many locations or scan-level analytics for campaign measurement — for a single-location business with infrequent destination changes, it's often unnecessary cost.
Should a business operating in India treat its UPI QR code as a marketing tool the way US/Europe retailers treat QR codes?
No — treat it primarily as payment infrastructure with its own security and reliability requirements; any marketing use of QR codes in that market should be treated as a separate, additional use case layered on top, not the same mechanism.
Sources
- https://scanova.io/blog/qr-code-statistics/
- https://wavecnct.com/blogs/qr-code-statistics
- https://www.qrcodechimp.com/qr-code-statistics/
- https://blog.menucardstudio.com/digital-qr-menu/qr-code-menu-examples-for-restaurants/
- https://www.supercode.com/blog/qr-codes-for-restaurants
- https://www.uniqode.com/blog/qr-code-security/secure-qr-codes-against-phishing-and-quishing-attacks
- https://keepnetlabs.com/blog/qr-code-phishing-trends-in-depth-analysis-of-rising-quishing-statistics
- https://www.acronis.com/en/blog/posts/qr-code-phishing-evasive-threats-2026/
- https://www.emarketer.com/content/how-qr-codes-help-marketers-seamless-commerce-developing-deeper-understanding-of-customers
- https://meetanshi.com/blog/upi-statistics/
Need this built into your business?
The free tools and prompts on this site handle the small, solved problems. If what you need is bigger — SEO, built and maintained for you — that's Scult's day job.
