QR codes are attractive for field verification: cheap to print, quick to scan, and they tie a digital record to a physical thing. But a QR code is just data that anyone can photograph and reprint. On its own it proves almost nothing about who scanned it or where.
What can go wrong
- Copying: the code is photographed and scanned from somewhere else.
- Replay: a scan is captured and submitted again later.
- Substitution: a fake sticker replaces the real one.
- Spoofed location: device location is faked.
- Lost or shared devices: a phone gets into the wrong hands.
- Sync conflicts: records created offline collide when the device reconnects.
Make the scan mean something
The defence is layering. The scan becomes evidence when it is combined with other facts the server can check:
- Identity: the scan is tied to an individually authenticated user with a role that permits it.
- Authority: the server checks the user is assigned to that target, not just that the code exists.
- Time: timestamps come from the server, and the same code scanned twice in an implausible window is flagged.
- Location: capture it, check it against the target, and treat it as a signal rather than proof.
- Codes that carry little: encode an opaque identifier, not data, and look everything up server-side.
Plan for the bad day
- Remote session revocation for a lost device.
- Minimal data cached on the phone, protected by the OS.
- Clear conflict rules for offline records, with the audit trail showing both versions.
- Records that cannot be edited afterwards, with corrections as new entries.