QR Codes for Banks and Financial Services

Where codes genuinely help

• Payments. Scan-to-pay with the amount and reference pre-filled removes the two causes of failed and misapplied transfers. On invoices and bills this is the strongest case in the sector.
• Onboarding. A code on a paper form or in a branch moves the applicant onto their phone, where the camera can capture identity documents. It turns a twenty-minute desk process into a self-service one.
• Secure login and device pairing on desktop banking, where a scan confirmed in the app is both faster and safer than typing a one-time code.
• Statements and correspondence. A code on a printed statement that opens the same document in the app, correctly authenticated, cuts printing and calls at once.
• ATM and branch signage for opening hours, appointment booking and service alerts, which is the cheapest way to keep a physical estate current.
• Card activation and replacement, where the alternative is a phone menu nobody enjoys.

The fraud problem, stated plainly

Criminals stick their own codes over legitimate ones on parking meters, invoices and branch posters. The customer sees a familiar logo and a square, and the square goes somewhere else entirely. This is the defining risk for the sector and it is a design problem, not a customer-education problem.

What actually reduces it:

• Never ask for credentials after a scan. Make it a stated rule in your communications, so a page that asks becomes obviously fraudulent.
• Use tamper-evident material on anything printed in a public place, and inspect it on a schedule.
• Publish the domains your codes resolve to, so a customer can check the address bar against a short, known list.
• Prefer in-app confirmation over any flow that starts by typing a password on a page reached from a scan.
• Teach staff and customers to read the URL before tapping, which is the one habit that defeats the whole attack. The security overview covers the attack patterns in detail.

What not to do

• Do not put a code on a letter about fraud. It trains exactly the behaviour you are warning against.
• Do not use a third-party shortener in the middle of the chain. The customer cannot verify it and neither can you.
• Do not encode account numbers or personal data into the pattern. Anyone who photographs the printed item can read it.
• Do not point a code at a login page as the first step. Start at an informational page under your own domain and let the app handle authentication.

Measurement and consent

Scan analytics are personal data when they can be tied to a customer or a device. Treat a scan like any other tracked interaction: a lawful basis, a retention limit, and the same consent posture as your website, as set out in the scan tracking and consent guide. Regulated firms have less room to improvise here than most sectors.