Why QR instead of a POS integration
POS-integrated loyalty is more accurate — the reward is tied to the actual transaction — but it requires that specific POS, its hardware, and usually its monthly fee. For a business that takes cash and transfers as often as cards, that is a large amount of infrastructure for a stamp card.
QR needs a phone on each side and nothing else. That is the entire reason it dominates among small businesses in markets where POS penetration is low.
Scan direction decides your fraud exposure
Business scans customer: the customer's code is unique to them, and staff must scan it in person. A stamp cannot be issued to someone who is not there. This is what Bioflow does.
Customer scans business: one code sits at the register for everyone. It is faster, and it is trivially abusable — a photograph of that code awards stamps from anywhere, indefinitely. Avoid it for anything with a real reward attached.
What QR cannot do
It cannot see the basket. The system records a visit, not what was bought, so a rule like "one stamp per $200 spent" depends entirely on staff applying it correctly.
It does not work without a phone. A customer without a charged phone at the counter cannot be stamped, which is a genuine, if small, share of walk-ins.