A staff member in a different service area today sent me a query by email:
"I was just wondering whether it would be useful for any new play area signs / outdoor gym signage to include the Parks web address to report any issues (alongside the current telephone number), together with a QR code?
I wondered if there was a specific reason why this has not been suggested/implemented before"
Although I wouldn't have a formal remit to reply to this (and to be honest I don't know whose remit it might formally be), in respect of the specific part of the query regarding QR codes, I gave this personal reply:
I would, in the strongest possible terms, advise not to put QR codes or any similar non-human readable graphics on things which are in the public realm which are effectively unsupervised, ie, signs.
Whilst it might seem like a nice convenience to enable a user to just whip their phone out and connect to the relevant web page with the camera on their phone, it also represents a potential serious security risk to users; an admittedly small risk, but a small risk the consequences of which could be catastrophic both for affected users and the reputation of the organisation.
The reason for this is a user has no idea what website they are going to be taken to before they land on it, because a user can't read the code. And if the sign, leaflet, or whatever is left unsupervised in the public realm there is nothing to stop a Bad Guy from creating an alternative site, printing out the QR code of the URL at the exact same size as the one on the sign, and sticking it over the existing one on the sign.
It could be a harmless alternative prank by Birmingham's very own Foka Wolf, it could be to a site considered Not Safe For Work, or at worst it could go to a phishing site which looks identical to the organisation's website which might capture the user's ID credentials and/or their banking information.
In short, please, do not do this, and if you overhear anybody else considering doing this, please advise them in the strongest possible terms not to do it either.