QR Codes for Promotions: The Complete 2026 Playbook

Promo QR is not one mechanic. It is six discrete patterns, each with its own fraud profile, redemption flow, and reporting requirement.

On-pack promo redemption (BOGO, $X off, percent-off). The QR sits on the package, the wrapper, or a printed sleeve. Customer scans, lands on a redemption page, applies the offer at checkout. The biggest decision is whether the QR is shared (one URL across all units) or unique-per-unit. Shared is cheap and the coupon-aggregator sites will scrape it within hours. Unique-per-unit kills the aggregator leak.

Sweepstakes and contest entry (no purchase necessary, plus the AMOE compliance path). The QR routes to the entry form. The /industries/promotions-qr-codes page covers the AMOE compliance architecture in depth. From the QR perspective the rule is simple: per-channel UTM tags so you can defend the regional entry-distribution data, and per-piece uniqueness if the sweepstakes carries a high-value prize (one entry per QR scan beats one entry per IP for fraud control).

Free-sample claim (sample request, mail-in, in-store pickup). QR routes to a sample-request form pre-filled with the source channel. The fraud control here is address-uniqueness on the backend, not QR-uniqueness — same household submitting under different names is a CRM problem, not a QR problem.

Loyalty-tier unlock (members-only promo, tier-gated offer). QR routes to a login-required landing page; the offer only redeems for authenticated tier-eligible members. This is the cleanest fraud profile of the six mechanics — the auth layer carries the fraud control, the QR is just the entry path.

QR-on-receipt rebate claims (post-purchase rebate, scan-to-claim). QR printed on the receipt routes to a rebate-claim flow that knows which transaction generated the scan. The receipt-side QR is the highest-converting rebate-claim channel because the customer is already in the post-purchase moment. Static, almost always.

Hidden-message reveal (gamified promo, scratch-and-reveal-equivalent). QR routes to a server-side reveal page that knows which unit was scanned. The mechanic only works with unique-per-unit QRs — a shared URL turns the game into 'everyone wins the same thing,' which kills the game.

Not every campaign uses all six. The CPG launch promo typically runs on-pack redemption plus sweepstakes entry. The DTC quarterly promo runs on-pack redemption plus loyalty-tier unlock. The restaurant happy-hour promo runs date-bound on-pack redemption only.

This is the section every other QR-for-promotions post skips, and it is the single most consequential decision in promo QR architecture.

A shared QR is one URL printed across all units. Every package, every coupon insert, every shelf talker carries the same code. It is cheap (you generate one code), it is simple to print, and it is fraud-vulnerable. A customer screenshots the URL, posts it on a coupon-aggregator site, and within 4 hours the offer reaches an audience you never targeted. Redemption volume blows past the budget cap. The promo is technically a success — record redemptions — and operationally a disaster.

A unique-per-unit QR assigns a different code to every printed piece. The CSV looks like 1,000,000 rows, each row encoding a different URL or a different unique parameter. The scrape-and-share attack still works against any single code, but the backend redemption layer enforces one-redemption-per-code, so the leaked code is a one-shot weapon, not a renewable fraud channel. Most CPG promotions running prizes above $25 face value use unique-per-unit. Below $25, the fraud math sometimes favors shared.

The operational cost difference is real. Unique-per-unit requires bulk generation (CSV import or API), per-code analytics, and a redemption backend that can enforce one-time-use. The vendor you pick for this is the vendor with bulk QR generation that actually scales to 1M+ codes in one batch, not the one with a manual UI that times out at 500.

Most CPG promotions split the difference: shared QR for the low-value mechanic (50¢-off coupon), unique-per-unit QR for the high-value mechanic (sweepstakes entry, $5 rebate, instant-win game). Read the permanent QR code guide before committing to a vendor — bulk generation depth varies wildly and is the first thing that breaks at scale.

Pick the row that matches your campaign. The table is opinionated — it reflects what we have watched work and fail across promo deployments.

A 1M-unit on-pack promo prints in February. The campaign runs March 1 through March 28. The marketing team cancels the dynamic-QR subscription in May, after the campaign report is done.

If the QR vendor deactivates dynamic codes 30 days after cancellation — and several do — every redemption attempt against residual on-shelf stock dies in June. Inventory still in the channel becomes deactivated-promo inventory. Customers scan the on-pack QR, hit a 404, and tell their friends the brand's promo is broken.

This is the single biggest hidden risk in promo QR procurement, and the feature comparison spreadsheets never include it because the vendors do not lead with it.

The math on a 1M-unit run: even if only 0.3% of residual stock generates a late scan (typical for an on-pack promo with 6–12 months of shelf life), that is 3,000 customer touchpoints landing on 404 pages. Customer service tickets, social media complaints, the rep on the regional sales team flagging the brand manager. The reprint cost on the residual inventory is not in the budget. The remediation is to negotiate emergency reactivation with the vendor — and you are negotiating from the position of needing the service immediately, which is not the position you want.

The vendors that deactivate dynamic codes after cancellation include Flowcode (30-day window per current support docs) and QR Code Generator (qr-code-generator.com, deactivation per published ToS). Bitly applies different retention rules to free, paid, and cancelled accounts; ambiguity is its own risk. Verify in writing from vendor support before you commit a single print run.

The vendors that keep codes active after cancellation include EZQR (indefinite redirect on dynamic codes), QR Tiger (per published ToS), and Uniqode (per current ToS, though the Beaconstac→Uniqode rebrand broke other policies for legacy customers — verify in writing).

The permanent QR code guide covers the vendor-by-vendor cancellation policies in detail. Read it before you commit on-pack art.

Promotions are bursty. The campaign runs 4 weeks. The print run was scoped in Q4 for an H1 launch. The team rotates onto the next campaign as soon as the current one closes. The QR layer should match the rhythm.

Annual-billing vendors do not match the rhythm. QR Tiger's Lite plan runs $37/mo, billed annually at $444/year. Uniqode's Lite plan runs $49/mo, billed annually at $588/year. For a single 4-week campaign you are paying 12 months for one month of active use, and the cancellation policy still gates whether the codes keep working after.

Monthly billing flips the math. EZQR Max at $20/mo, monthly, covers a 4-week promo end-to-end. Generate the codes (bulk if you need unique-per-unit, single if you need shared), run the campaign, pull the analytics, cancel after. The codes keep redirecting because EZQR funds redirect infrastructure from active subscribers rather than deactivating ex-customers. Total cost: $20 for the campaign that QR Tiger charges $444 for.

The model is structurally right for promo timelines in a way the feature comparison sheets do not capture. The right question is not 'what does the vendor charge per month' — it is 'how does the vendor's billing model align with my campaign duration, and what happens to my printed codes when I stop paying.'

For a marketing team running 4 promos a year with 6–8 weeks of active billing each: monthly is $160 total. Annual would be $444–$588 in lock-in for the first vendor, sometimes multiple vendors if the campaigns sit in different agencies. The savings compound across the year, but the more important point is the cancellation safety — the printed assets still in circulation after the campaign ends are not at vendor-policy risk.

If the campaign exceeds 4 weeks and you need API access for programmatic generation across thousands of retail locations, the Max tier covers it. The hidden costs guide covers the line items vendors hide in annual-billing pricing.

If your campaign needs unique-per-unit QRs, the vendor's bulk-generation capability is the first technical filter. Manual UIs that ask you to generate codes one at a time top out around 500 codes before the experience becomes punishing. Real bulk generation is CSV import (you supply 1M rows of destination URLs and per-code parameters) or API-driven generation (your backend issues 1M create-code calls).

The typical CPG promo print run sits at 100K to 5M units. The QR generation has to keep up with the print run; if generation takes longer than the print scheduling allows, the campaign slips. The bulk QR generators comparison covers the vendor-by-vendor scale ceilings.

The per-code analytics matter too. A 1M-unit batch with per-code redemption tracking means the dashboard has to handle 1M rows of scan data without falling over. Some vendors aggregate at the batch level (you see batch-level scan counts but not per-code) — which kills fraud detection because you cannot see which specific codes redeemed multiple times.

The API integration matters for promo teams running multiple concurrent campaigns. The QR generation should plug into the marketing-automation stack (Klaviyo, Iterable, Braze, or your CDP) so the scan events flow into the customer record rather than living in a vendor dashboard you check manually.

For mid-size promo teams running 4–10 concurrent campaigns with bulk QR needs across each, EZQR's URL QR generator and bulk generation flow handle the CSV and API patterns. Multi-URL QRs (one QR routing to different destinations based on rules — geo, time-of-day, scan number) are covered by the multi-URL QR pattern when the campaign needs more than a single destination.

The QR is one tap. The landing page is where the redemption actually happens, and most promo landing pages over-engineer the flow.

The redemption page should be single-step. No app download, no signup, no confirm-your-email loop. Scan, see the offer, claim. Every additional step drops conversion by 10–20%, and the customer expectation for a promo QR is 'one tap and done.' Anything else feels like a bait-and-switch.

Mobile-first is non-negotiable. The QR was scanned on a phone; the page renders on a phone. Test on iPhone Safari and mid-range Android Chrome in portrait mode before you launch — those two render the majority of scans and they handle CSS differently than the design-team Mac browser does.

The page should answer 'what happens next' in the first 4 lines above the fold. 'Tap to apply 20% off at checkout' or 'Enter your email to claim your free sample' or 'Your sweepstakes entry is confirmed.' If the customer has to scroll to figure out what they got, they bounce.

The page should not ask for more data than you actually need at this step. The CPG-promo pattern of asking for name, email, phone, birthday, and dietary preferences at the redemption gate drops conversion by 40–60%. Capture email at the redemption; capture the rest in the post-redemption nurture sequence.

For on-pack BOGO and rebate promos, the landing page should integrate directly with the ecommerce platform's coupon/promo engine — Shopify Scripts, BigCommerce promotions, Magento price rules — so the discount applies at checkout without the customer copying a code. Per-code unique URLs handled by the QR vendor's redirect layer plus per-code single-use enforcement in the ecommerce engine is the standard architecture.

For sweepstakes entry, the landing page is the entry form plus the official rules link plus the AMOE notification. Promotions counsel should review the page copy before launch. The /industries/promotions-qr-codes page covers the AMOE architecture in detail.

Redemption rate is the metric that determines whether the promo gets renewed for next year, and most promo teams report it sloppily.

There are three different numbers, and they do not interchange.

Scan rate of impressions. What fraction of the audience that saw the printed asset scanned the QR. For on-pack consumer promos this typically runs 0.5–3% of unit impressions; for direct-mail it runs 2–8%; for in-store shelf talkers it runs 1–4%. Wide ranges because the variables (category engagement, prize value, channel placement, call-to-action clarity) move the number significantly. If your scan rate is below 0.5% on on-pack, the QR is invisible — placement, contrast, or call-to-action is broken.

Claim rate of scans. What fraction of scanners completed the redemption form or applied the offer. Typically 25–40% on consumer promos. A claim rate below 20% usually means the landing page is broken (form too long, friction too high, expectation mismatch with the on-pack copy). Above 50% means the offer-to-friction ratio is well calibrated.

Verified-redemption rate of claims. What fraction of claims resulted in a verified purchase, sample shipment, or sweepstakes entry that passed eligibility checks. Typically 60–80%. The gap between claims and verifications is fraud (caught by the backend), duplicate submissions (caught by address-dedup), or ineligible submissions (out-of-region, underage, etc.).

Multiply through: if a 1M-unit on-pack promo runs 2% scan rate × 35% claim rate × 75% verified rate, you get 5,250 verified redemptions on 1M units printed. That is the actual ROI denominator, not the 20,000 scan events the QR dashboard celebrates.

Report all three numbers in the campaign wrap. Conflating them — leading with 'we had 20,000 scans!' — inflates the wins and makes year-over-year comparison meaningless. The QR analytics guide covers which vendors surface all three vs only scan counts.

Unique-per-unit QRs are the foundation of promo fraud prevention. They are not the whole stack.

Geolocation gating. The redemption page checks the scanner's geolocation (with permission) and rejects scans from outside the campaign region. Useful for region-bound promos (NY-only sweepstakes, US-only rebate). The catch: customers refuse the geolocation permission roughly 30–50% of the time, so the gate cannot be hard — it has to fall back to a self-reported region with backend verification.

Time-window gating. The redemption page rejects scans outside the campaign window. Combined with dynamic destination rotation, the QR points at the active offer during the window and a 'next promo coming soon — sign up for early access' page after. Avoids the 404 problem on residual stock without honoring the offer outside the active window.

Device-fingerprint dedup. The backend identifies the scanning device (browser fingerprint, IP, device characteristics) and caps redemptions per device. Useful for limiting one-redemption-per-household; bypassable with effort. Stack with email-uniqueness on the redemption form for stronger control.

Captcha on claim form. Standard hCaptcha or reCAPTCHA on the redemption form catches the bulk-bot redemption attempts that hit aggregator-shared codes. Adds 2–3 seconds to the redemption flow; worth the friction on any promo above $5 face value.

Address validation. For sample requests and physical-prize sweepstakes, address validation at form submission catches the fake-address fraud pattern. USPS address verification API, SmartyStreets, Loqate all integrate cleanly with the redemption form.

What's overkill for most promos: blockchain-based redemption verification, biometric authentication, multi-step verification flows that ask for ID upload. The conversion penalty exceeds the fraud savings on anything below a $100 face-value prize. The QR error correction guide covers the printing side — high error correction (level Q or H) makes the QR more resistant to print damage that would otherwise be misread as fraudulent.

The feature comparison spreadsheets the vendors send do not surface the things that actually matter for promo campaigns. Here is the comparison filtered to the promo-relevant dimensions.

These are often grouped under 'on-product QR' and they should not be. The economics are completely different.

QR-on-receipt has zero incremental print cost. The receipt printer at the POS adds the QR to the existing thermal print job. The customer touchpoint is post-purchase — they have already bought, and the QR routes to a rebate claim, a loyalty enrollment, or a review request. The ROI denominator is receipts printed (nearly free at the margin), so even a 1% claim rate is positive contribution. The pattern is structurally favored for any retailer with POS integration.

Receipt QRs are typically static (the destination URL is stable — the loyalty enrollment page, the rebate-claim flow, the Google Business Profile review link) and per-transaction unique via URL parameters carrying the transaction ID. The transaction ID lets the backend know which receipt is claiming, which prevents the scanned-from-someone-else's-receipt fraud pattern.

QR-on-packaging carries the full print cost of the on-pack art. The design, the proofing, the production run all reflect the QR placement decision. Wrong placement, wrong size, wrong contrast, wrong destination — and you are reprinting at scale or accepting the loss. The customer touchpoint is pre-purchase or at-purchase, depending on whether the QR is on the outside of the shelf-visible package or on a sleeve the customer reads after pickup.

On-pack QR is unforgiving in ways receipt QR is not. The print run is locked at production sign-off; corrections require recall. The cancellation policy of the QR vendor amplifies the risk because the printed asset is in market for the full shelf life of the SKU. The packaging QR guide covers the print specs, contrast requirements, and error-correction trade-offs for on-pack deployment.

For most CPG promos, the canonical answer is to run both: on-pack QR drives awareness and primary redemption; receipt QR captures the post-purchase nurture (loyalty enrollment, review request, rebate claim on items where rebate is the mechanic).

From a year of watching promo teams run QR campaigns, the campaigns that go well share an operational discipline at four checkpoints. The campaigns that go poorly skip at least one.

Pre-launch (4–8 weeks before). Design the QR placement adjacent to the call-to-action copy — never floating without context. Lock the destination URL and the destination rotation schedule (active, post-active, evergreen). Verify the redemption flow end-to-end on three phones (older iOS, current Android, current iOS). Define the fraud controls (unique-per-unit threshold, captcha, address validation). Verify the vendor's cancellation policy in writing and save the response. The cancellation policy verification is the step every promo team intends to do and 60% skip.

Launch day. Audit physical placement on a sample of distributed assets (store walkthroughs for retail signage, sample packs for on-pack, mail-piece pulls for direct mail). Scan-test on three phones from the actual placement (not the design-team Mac). Confirm the redemption page loads under 3 seconds on a slow 4G connection. Confirm the analytics pipeline is recording scans, claims, and verified redemptions separately.

Mid-flight (weekly). Monitor fraud-rate signals — unusual scan velocity from a single IP, redemption clusters from a single device fingerprint, claim rate spikes above the expected band (usually indicates coupon-aggregator pickup). Check the redemption curve against the projected curve and reallocate channel spend if a channel is underperforming. The trackable QR generators comparison covers which vendors surface real-time velocity vs daily aggregates.

Wrap (after campaign close). Pull the three redemption-rate numbers (scan, claim, verified) by channel and by region. Document the cancellation policy reassurance for any residual stock still in the channel — the QR keeps redirecting for late redemptions, the customer service team is briefed, the social-media monitoring is in place for any 404 reports. The retail QR stack guide covers the longer-tail considerations for promos that overlap with retail signage.

Promo QR has a long tail of features that vendors will sell you and that you do not need.

Gamification overlays on simple promo QR. A 50¢-off coupon does not need a spinning wheel of fortune. The friction reduces redemption; the gamification entertainment value does not offset. Reserve gamification for the campaigns where the entertainment is the offer (sweepstakes entry, instant-win mechanics) rather than the bolt-on.

AR overlays on promo packaging. AR adds a 5–10 second loading delay and requires the customer to hold the phone steady in unflattering positions. Conversion drops. AR works for product visualization (apparel try-on, furniture-in-room) where the AR is the value. For a promo redemption, it is friction.

'QR for the sake of QR' on assets that already work. A printed coupon with a clearly typed promo code in 14pt type does not need a QR. Add a QR if the audience is older (typo recovery), if the redemption volume is large enough that the typo loss is meaningful, or if you need the per-channel attribution data. Otherwise the QR is decoration.

Custom-designed QR codes that compromise scan reliability. Branded QR codes with logos in the center and color gradients across the modules look beautiful and scan 15–30% less reliably than standard high-contrast QR. For a promo where every scan represents a paid impression, the reliability loss is expensive. The error correction levels guide covers the trade-off between design freedom and scan reliability.

Vendors that bundle QR with a full marketing-automation suite. You already have Klaviyo, Iterable, or Braze. You do not need a second marketing-automation tool inside your QR vendor. Pick the vendor whose QR layer integrates with the marketing-automation stack you already run, not the one that tries to replace it. The subscription traps guide covers the bundling patterns that lock teams into duplicate tooling.

For most promo campaigns the QR stack is: a generator with bulk generation and monthly billing, the existing ecommerce or CRM as the redemption backend, the existing analytics stack as the attribution layer, and a cancellation policy that keeps the codes alive for the residual stock tail. Nothing fancier.

The foundational QR standard is ISO/IEC 18004; any vendor that does not encode against the spec produces codes that fail on a fraction of phones. The Wikipedia QR code article is the cleanest plain-English reference for the encoding, error-correction levels, and scan-distance math. For the broader generator comparison across all categories, /blog/best-qr-code-generators-2026 is the cross-vertical reference.