Are NFC and QR review cards safe?

Some customers hesitate before tapping a card or scanning a code, and after years of scam warnings that is reasonable. The good news is that a tap point is very limited in what it can do. The real risk is not the technology, it is someone swapping your code for theirs.

What a tap point can do

A review card or stand holds a small piece of information, usually a web address. When a phone taps it or scans the QR, the phone shows the link or opens the page. That is all.

What it cannot do

A tag or QR code cannot read the contents of the customer’s phone, take their contacts, access their photos or install anything on its own. The phone is in control. It shows a notification or preview, and the customer chooses whether to open it.

The real risk: tampering

QR code scams, sometimes called quishing, are widely warned about in Australia. A common trick is to stick a fake QR sticker over a genuine one, so customers are sent to a phishing page instead of the real site. A rewritable NFC tag could in theory be overwritten by someone with the right app if it was never locked.

For a business, that means a tap point in a public place deserves the same attention as anything else a customer trusts.

How to protect your customers

Check your stands. Once a week, look for stickers or covers over the QR, and tap and scan to confirm they open your real Google page.
Keep stands where staff can see them. A stand at the counter is much harder to tamper with than one in an unattended corner.
Know whether your tags are locked. See can you change the link on an NFC review card.
Replace anything damaged rather than taping over it.

What your customers should see

A genuine review link opens a Google page with your business name at the top, and asks for nothing but a rating and a review. It never asks for a bank card, a password or a payment. If a customer ever says your code asked for any of those, take the stand out of service and check it.