Financial services get more value from QR codes than most industries and carry more risk from them. Both facts come from the same place: money moves at the end of the scan.
Make a QR code freeQR code phishing — codes stuck over legitimate ones, or printed on convincing fake letters, leading to credential-harvesting pages — targets financial services more than any other sector. It works because the destination is hidden until after the scan and because customers are conditioned to expect banks to ask for verification. This changes what a bank or insurer can responsibly print: never a code that leads to a login or payment page, always a code that leads to a public, verifiable page on your primary domain, and always with the URL printed in text beside it so a customer can check.
Policy and product documents on printed correspondence, replacing pages of small print with a link to the current version. Claims process guidance on a letter or a card in the glovebox, at the moment someone actually needs it. App download codes on statements and in branch. Branch and ATM location codes. Educational and calculator tools on printed marketing. Appointment booking with an adviser. All of these are informational, none require credentials, and all are safe to print.
Codes are widely used to move a customer from a branch or a paper form onto their own device for identity verification, and that is legitimate — but the code should start a session, not carry one. Point it at a public entry page where the customer authenticates themselves; never encode a session token, a reference that grants access, or a personalised link in something printed. The distinction sounds subtle and is the difference between a convenience and an account takeover.
Printed payment codes on invoices, parking machines and public signage have been the vector for enough fraud that several jurisdictions now warn about them explicitly. If you must use one, keep the destination on your own domain, print the payable amount and reference in text beside the code, and tell customers plainly that you will never ask them to scan a code to verify an account or reactivate a card. That last message, printed repeatedly, does more for customer safety than any technical control.
Ten types, twelve designs, PNG, SVG, and PDF download. No account, no expiry, and nothing you type leaves your browser.
Six rules that decide whether a QR code gets scanned: print size, contrast, quiet zone, error correction, a call to action, and testing on real phones.
ReadRestaurants, packaging, out-of-home advertising, events, retail, and field services. Where QR codes earn their place, and which type each one needs.
ReadHow to use QR codes on letterheads, invoices, envelopes and compliment slips — what to link, where to place them, and the fraud risk on invoices.
ReadA static QR code can never be changed or measured. A dynamic one can be re-pointed after printing and tracks every scan. How to tell which your campaign needs.
Read