The idea behind a QR code stamp card is straightforward: a customer visits your venue, scans a code, and collects a stamp. Repeat visits build up to a reward. Simple, digital, no paper required. But there is a detail that most loyalty platform providers gloss over, and it has meaningful consequences for your business: the difference between a static QR code and a dynamic one.

If your loyalty programme uses a static QR code — one that never changes — you have a fraud problem. It may not surface immediately, but it will surface. And when it does, you will be paying for rewards that went to people who never visited your restaurant.

How Static QR Codes Work

A static QR code encodes a fixed piece of data — usually a URL. Once generated, it never changes. You can embed it in a poster, put it on a table tent, or include it in a printed flyer. Scanning it at any point in time produces the same result.

For many use cases, static QR codes are perfectly appropriate. A link to your menu, your Wi-Fi password, a directions page — these do not need to change, and a permanent code is exactly right.

For a loyalty stamp card, static QR codes are a security hole.

The Screenshot Problem

The moment a customer scans your static loyalty QR code, they have a record of it. Their phone's camera roll contains an image of the code, or the URL is saved in their browser history. They can share that code with anyone — family members, friends, colleagues — without any of those people ever visiting your venue.

Here is how the abuse plays out in practice. A customer visits once, collects a stamp, and photographs your QR code on their way out. They post it in a group chat. Eight people in that chat now have your QR code. They all "collect" stamps from their sofas. Within a week, several of them have earned a free meal or a free coffee — without ever walking through your door.

You have paid for rewards that generated zero actual visits, zero revenue, and zero genuine loyalty. The people who abused the system have no emotional connection to your venue. They redeemed a freebie and moved on.

Why Printed Loyalty Codes Are Particularly Vulnerable

Some businesses take this further and embed their loyalty QR into physical signage — on the wall, on table cards, on receipts. This makes the exposure permanent and totally uncontrollable. Every visitor who photographs it, every person who takes a leaflet home, every image posted to social media showing your venue interior — any of these can carry your loyalty code into the world indefinitely.

Once a static QR code is published anywhere — a receipt, a wall, a social media photo — it is effectively public forever. You cannot unpublish it without replacing all the physical materials it appears on, and even then the old photos remain.

What Dynamic QR Codes Do Differently

A dynamic QR code does not encode a fixed URL. Instead, it encodes a signed token that includes a timestamp. The code is valid for a short window — typically 30 seconds — after which it expires and a new one is generated automatically.

The server that receives a stamp request first checks the timestamp and the cryptographic signature embedded in the token. If the code is older than 30 seconds, or if the signature does not match what the server expects, the stamp is rejected. The request fails silently, or with an error message.

A customer who photographs the code cannot use it in ten minutes, because in ten minutes that code has already expired and been replaced eighteen times. Sharing it in a group chat is useless. Posting it online is useless. There is no screenshot that can be turned into a stamp, because every stamp requires a live code scanned at the moment it is displayed.

HMAC Signing: The Technical Layer That Makes It Work

The security of a dynamic QR loyalty code depends on the signing mechanism. The industry-standard approach is HMAC — Hash-based Message Authentication Code. Here is how it works at an approachable level.

When your device generates a QR code, it takes the current timestamp, combines it with a secret key known only to your server, and runs it through a mathematical function. The result is a short string of characters that is effectively impossible to reproduce without knowing the secret key. This string is embedded in the QR code alongside the timestamp.

When a customer scans and a stamp request arrives at the server, the server repeats the same calculation using the same secret key and the timestamp from the request. If the result matches what was embedded in the code, the request is genuine. If it does not match — because someone tried to construct a fake code or reuse an old one — the request is rejected.

The secret key never leaves the server. No one can forge a valid code without it. This is not security through obscurity; it is the same family of techniques used to sign API tokens, authorise payment requests, and protect online banking sessions.

What This Means for Your Stamp Card Programme

For you as a restaurant or café owner, the practical implication is this: every stamp in your system represents a real visit. A real customer stood in your venue, your staff displayed a live QR code on their phone screen, and that customer scanned it in that moment. That stamp cannot have come from anywhere else.

Your reward budget is therefore going entirely to people who have genuinely engaged with your business. Your visit data is clean. Your customer relationship is real.

When you are deciding how to structure your rewards — a free dish after ten stamps, a discount after seven — you are working from accurate numbers, not numbers inflated by abuse.

How Tavolo Plus Handles This

Tavolo Plus uses a 30-second rotating HMAC-signed QR code displayed on your phone. Your staff show the code on their screen; the customer scans it. Every 30 seconds the code refreshes automatically, with no action required from staff. The server validates every stamp request against the expected signature and timestamp before accepting it.

There is nothing to set up beyond enabling the feature in your dashboard. No hardware, no configuration, no separate security layer to manage.

If you want a digital stamp card that is resistant to abuse from day one — not as an add-on or a premium tier, but as the default — Tavolo Plus is built with this as a core requirement, not an afterthought.

Why Your QR Code Stamp Card Should Never Use a Static QR Code