QR code tracking: how to tell which placements bring in sales
Photo by Tim Douglas (opens in a new tab) on Pexels
A QR code dashboard counts phones that opened a link. It does not count people, it does not count the customers who saw the code and phoned instead, and it says nothing about sales. Here is how to set codes up so a scan can become a lead with a phone number or email, and how to judge every truck, sign, flyer and mailer by the sales it closed.
Contents
- What QR code tracking actually measures
- Static vs dynamic QR codes
- One code per placement, with a tagged destination
- What scan counts can and can't tell you
- Turning a scan into a matchable lead
- Placement by placement: what a scan can become
- Judging each placement by matched sales
- Malicious QR codes: protect the placement and the customer
- A setup checklist
QR code tracking counts phones that opened a link, not people and not sales. Use one code per placement with a UTM-tagged destination, land the scan on a page that captures a phone or email, record the placement in the lead's source, and rank placements by matched sales. Scan counts measure curiosity, not revenue.
A roofing company puts QR codes on everything it prints: three wrapped trucks, the yard signs it leaves at finished jobs, door hangers, a spring postcard. At the end of the quarter the generator's dashboard has one clear winner. The trucks drew 1,180 scans, almost two-thirds of the total, and the owner starts pricing a fourth wrap.
The trucks closed three roofs. The yard signs, with a quarter of the scans, closed nine. Nothing in the dashboard was wrong; it was answering a different question. A scan count measures how often a phone camera met a printed square, which depends on how many people walk past it, how curious they are and how often the crew tests its own code in a parking lot. It does not measure who wanted a roof. This post covers how to set codes up so that question can be answered: static and dynamic codes, one code per placement, tagged destinations, the page that turns a scan into a lead, and the arithmetic that ranks placements by what they sold.
What QR code tracking actually measures
A QR code is a printed web address. Tracking it means counting requests: either the generator counts hits on a redirect it hosts, or your analytics counts visits to a tagged URL. Both record that a phone opened the link, when and roughly where. Neither knows who the person was or whether they ever bought anything.
That is useful, and it is less than it looks. A scan is a piece of evidence that a placement was seen and acted on in the moment. It is good for spotting a dead placement, a code printed too small to scan, or a sign that stopped getting scans because somebody covered it. It is a poor guide to revenue, for three reasons that come up again below: scans are not people, most of the response to a printed piece never scans anything, and the scans that do happen are by curious people more than by buyers.
For businesses that close by phone or in person, such as home services, real estate, restaurants, shops, clinics and trade-show exhibitors, the code is also the only digital step in an otherwise offline journey. The scan happens on a phone, the sale happens at a kitchen table or a counter, and nothing joins them unless you build the join. That is the real job of QR code tracking, and the scan counter is only its first step.
Static vs dynamic QR codes
A static QR code encodes the destination itself, so it cannot be edited after printing and nothing counts its scans except your own analytics. A dynamic code encodes a short redirect hosted by the generator, so the destination can be changed and every scan is counted, but the code works only as long as that redirect does.
| Static, direct to the page | Dynamic, vendor redirect | Static, to a redirect on your domain | |
|---|---|---|---|
| Destination editable after printing | No | Yes, in the vendor's dashboard | Yes, on your own server |
| Scan counts | Only as visits in your analytics | Yes, from the vendor | From your server logs and your analytics |
| Address shown before opening | Your page | The vendor's short domain | Your domain |
| Works if you stop paying a vendor | Yes | Only if the vendor keeps the redirect | Yes |
| What can go wrong | A typo is printed forever | A lapsed plan breaks every printed code | A redirect that drops the UTM tags |
| Good for | Short runs, permanent pages | Large runs, quick setup | Anything printed in volume or kept for years |
Here is the arguable part. For a vehicle wrap, a sign that stays up for years or a mailing of 20,000 pieces, the third column is the one to choose. A short path on your own domain, such as yourcompany.com/truck2, printed as a static code and redirected by your own site to the tagged landing page, gives you the editing of a dynamic code without tying a $3,000 wrap to somebody else's subscription. It also shows your domain on the phone's screen before the page opens, which matters for the tampering problem covered below. The cost is one thing to test: a redirect that quietly drops the query string, which is one of the five places a source falls off described in our post on UTM parameters.
Vendor dynamic codes are a reasonable choice for everything else, and for anyone without access to their own site's redirects. Before printing in volume, read what the vendor says happens to the codes if the plan ends, because that is the scenario in which every flyer you have ever printed stops working at once.
One code per placement, with a tagged destination
Give each placement its own code, and point each code at a destination tagged with UTM parameters that name it: utm_source for where it was printed, utm_medium for the kind of placement, utm_campaign for the offer, utm_content for the specific item. A shared code tells you a scan happened; a placement code tells you where.
"Placement" means the smallest unit you would make a decision about. If you would keep one truck's wrap and redo another's, each truck gets a code. If you would never treat two yard signs differently, one code for all yard signs is enough, though a code per neighborhood is cheap and tells you where the signs work. A postcard gets a code per drop date, because the decision is whether to mail again. Here is a plan for the roofer, written before anything is printed:
| Placement | Printed path | utm_source | utm_medium | utm_campaign | utm_content |
|---|---|---|---|---|---|
| Truck 1, rear doors | /t1 | truck-wrap | qr | always-on | truck-1 |
| Truck 2, rear doors | /t2 | truck-wrap | qr | always-on | truck-2 |
| Yard signs, north side | /sign-n | yard-sign | qr | always-on | north |
| Door hangers, April | /dh | door-hanger | qr | spring-2026 | april |
| Postcard, 14 April drop | /pc | postcard | qr | spring-2026 | drop-0414 |
Three rules keep the plan usable. Write values in lowercase from a fixed list, because Google treats Truck-Wrap and truck-wrap as two sources. Keep the plan in one shared file, so the next person who orders signs does not invent a new spelling. And put the same placement name into the lead's source column when a lead arrives, because a placement that exists only in analytics never reaches the sale. Our print advertising post makes the same point for publications: decide the spelling before the first ad runs.
What scan counts can and can't tell you
Scan counts can tell you whether a placement is seen and acted on. They cannot tell you how many people scanned, because repeat scans, shared phones and testing inflate them, and they miss everyone who saw the code and called, typed the address or searched your name instead. Read them as a signal about the placement, not about revenue.
So even the best number in the dashboard is a device count. The others are worse. Here is what each scan figure includes that has nothing to do with demand, and what it leaves out entirely:
- Repeat scans. A homeowner scans the door hanger on Monday, again on Thursday to show a spouse, and a third time before calling. Three total scans, one person.
- Your own people. The printer checks the proof, the office manager checks the first box, every new crew member scans the truck once. On a placement with few real scans, testing can be a large share.
- Automated requests. Link checkers, security scanners and preview services can fetch a URL without a person behind them. Whether your generator filters them out is worth asking.
- The ones who never scan. Most people who act on a printed piece phone the number on it, type the short address, or search your name later. None of them appear as scans, and the searchers show up as branded search performance instead.
- Curiosity. A code on a truck at a red light gets scanned by passengers who want to see what happens. A scan proves somebody had the code in front of them, which is the same limit our post on promo codes describes for a code typed at checkout.
The last point is why a high scan count can be bad news. A placement that many people scan and few people call from is a placement that attracts browsers. On a billboard the problem inverts: a code is hard to scan from a moving car, so it undercounts badly, and a short phone number or web address on the board does more. Neither tells you anything about sales until the scan becomes a lead.
Turning a scan into a matchable lead
A scan can be connected to a sale only if the page it opens captures something the sale will also have: a phone number or an email. That means a short form, a tap-to-call number assigned to the placement, or both, with the UTM values copied into the lead record rather than left in the analytics tool.
The landing page is the part most QR setups skip. The code goes to the homepage, the visitor browses on a phone, and if they call it is from the number in the header, which is the same number every other channel uses. The scan is counted and then lost. A placement page fixes that:
- Built for a phone, one screen tall. The person is standing on a sidewalk or sitting in a waiting room. Say what the placement promised, in the same words, and put the action above the fold.
- A form with the two fields that match. Name, phone and email, with a line explaining why you ask for the phone. Our post on web form leads covers which fields make a submission matchable later and how people invent numbers when the reason is missing.
- Hidden fields for the tags. utm_source, utm_medium, utm_campaign and utm_content copied from the URL into the submission, so the lead carries its placement into the CRM. Check it by submitting a test lead from each printed code and finding it in the CRM.
- A tap-to-call number for the placement. A number shown only on that page, so the call log records the caller's number against the placement. Our post on call tracking and revenue explains why the call log still has to be joined to sales to mean anything.
- A reason to act now. A quote, a booking slot, a showing, a reservation or a loyalty sign-up. A page that only shows a menu or a brochure produces a scan and nothing to match.
The same rule applies to chat. A chat widget on the placement page that never asks for a phone or email produces a conversation and no lead, which our post on live chat leads works through. Whatever the page uses, the test is one question: when this person buys, will the sale record share a phone number or email with the lead record? If not, the placement can be counted but never credited.
Placement by placement: what a scan can become
Each kind of placement is scanned for a different reason, so each needs a different next step to produce a lead. The table below gives the usual reason, the step that makes it matchable, and the response the code will miss, which is the reason a placement's matched sales are always a floor.
| Placement | Why people scan it | What makes it a matchable lead | What the code misses |
|---|---|---|---|
| Vehicle wrap | Curiosity at a light or in a lot | Quote form or tap-to-call on the page | Drivers, who remember the name and search it |
| Yard sign (home services) | A neighbor checking the company | Quote form with phone | Neighbors who ask the homeowner for the number |
| For-sale sign or flyer (real estate) | Price, photos, a showing | Showing request or call to a number on that page | Calls to the agent's number on the sign rider |
| Door hanger or flyer | Checking the offer | Booking form with phone | The hanger on the fridge, phoned weeks later |
| Direct mail | The offer, a booking | Form on the page, plus the mail file itself | Most responders, who call or search |
| Print ad | Details | Form on a print-only page | Readers who type the address or phone |
| Restaurant table tent or receipt | Menu, review, loyalty | Loyalty or reservation sign-up with phone | Diners who come back without it |
| Retail window or shelf | Product details, stock | Alert or appointment sign-up with email | Buyers who walk in |
| Clinic waiting room | Forms, other services | Appointment request | Nothing new: most scanners are existing patients |
| Trade show booth | A demo, a download | Demo booking with a work email | Visitors already captured by badge scans |
Two rows deserve a warning. For direct mail, the QR code is the weakest measurement available, because you already know who received the piece: matching the mailing list against sales captures the callers and searchers a code never sees. Use the code for the people who want to book from the card, and use the mail file for the verdict. For a trade show, the scan of your booth's code and the badge scan are two records of the same visit; count people, not scans, as our post on event attribution argues. And in a clinic's waiting room, a high scan count is existing patients filling in forms, which is service, not demand.
Print it so it scans
A code that does not scan produces no data at all, and the dashboard cannot tell you why. Print the code large enough for the distance it will be read from, with a clear margin around it, in dark on light. Scan the printed proof at the real distance and angle, on more than one phone, before the run. Codes on wraps, signs and anything outdoors get dirty and scratched, and the standard allows for that.
Judging each placement by matched sales
Rank placements by the sales whose buyers appear as leads from them, not by scans. Divide spend by matched sales for cost per sale, and matched revenue by spend for return. The ranking usually differs from the scan ranking, because the placements people scan most are not the ones people buy from.
Here is the roofer's quarter. The figures are illustrative, not benchmarks. The leads column counts only leads that came through a placement page, by form or by its tap-to-call number, with a phone or email on them. Matched sales are closed jobs whose buyer's phone or email appears among those leads.
| Placement | Spend | Total scans | Unique scans | Leads | Matched sales | Matched revenue | Cost per sale | Revenue per $1 |
|---|---|---|---|---|---|---|---|---|
| Truck wraps (3) | $4,500 | 1,180 | 720 | 22 | 3 | $36,000 | $1,500 | 8.0 |
| Yard signs (60) | $1,200 | 310 | 240 | 41 | 9 | $99,000 | $133 | 82.5 |
| Door hangers (8,000) | $3,600 | 260 | 230 | 35 | 5 | $52,500 | $720 | 14.6 |
| Postcard (5,000) | $4,250 | 140 | 125 | 18 | 4 | $46,000 | $1,063 | 10.8 |
| Total | $13,550 | 1,890 | 1,315 | 116 | 21 | $233,500 | $645 | 17.2 |
The arithmetic. Trucks: $4,500 ÷ 3 = $1,500 a sale and $36,000 ÷ $4,500 = 8.0 per dollar. Yard signs: $1,200 ÷ 9 = $133 and $99,000 ÷ $1,200 = 82.5. Door hangers: $3,600 ÷ 5 = $720 and $52,500 ÷ $3,600 = 14.6. Postcard: $4,250 ÷ 4 = $1,063 and $46,000 ÷ $4,250 = 10.8. In total, $13,550 ÷ 21 = $645 a sale and $233,500 ÷ $13,550 = 17.2. The trucks drew 1,180 ÷ 1,890 = 62% of all scans and 3 ÷ 21 = 14% of matched sales.
Look at leads per unique scan. Trucks: 22 ÷ 720 = 3%. Yard signs: 41 ÷ 240 = 17%. Door hangers 15%, postcard 14%. The truck's audience is large and idle; the yard sign's is small and has just watched a neighbor's roof replaced. That is the finding, and no scan report could have produced it.
Now the caution, which matters as much as the ranking. Three sales is a tiny number: one more or one fewer moves the trucks' cost per sale by a third. The trucks also produce calls to the number painted on the side and searches for the company name, none of which pass through a placement page, so their matched sales are a floor. The honest conclusion is not "cut the trucks". It is "do not buy a fourth wrap on the strength of scans, put more yard signs out, and look at the trucks again after two more quarters".
CloseRev does not read QR scans, scan counts or UTM tags, and it connects to no QR generator or analytics tool. It reads two CSV files you export, closed sales and leads, and matches them: a sale counts toward a source when its normalized phone or email is in the lead file, credited to the earliest such lead, and only high-confidence matches count automatically. Sources report exactly as written in the lead file's source column, and sales with no match stay in Direct / Unknown.
Two consequences follow for QR placements in any matching approach. First, the placement must be written into the lead's source, with one spelling, or it cannot be reported at all. Second, a sale goes to the buyer's earliest lead: a homeowner who called from a search ad in March and scanned a yard sign in May is a search sale. That is a defensible rule, and it means a placement whose scanners were already in touch with you will look smaller than its scan count. The sales nobody can trace to any lead belong in their own line, as our post on unattributed revenue explains, not spread across the placements that seem likely.
Malicious QR codes: protect the placement and the customer
Criminals replace legitimate QR codes with their own, on paper with a sticker or in email and text messages, to send people to fake sites. For a business, a covered code steals the scans and the customer's trust at once. Print your address beside the code, use your own domain, and inspect public placements.
That advice is aimed at the person scanning, but it tells the business what to print. A code whose preview shows your own domain is one a careful customer can check; a code whose preview shows an unfamiliar short domain looks exactly like the thing the FTC tells them to distrust. So print the short address in readable text beside the code, use your own domain where you can, and never make a scanned page the place someone pays. For codes in public places, such as a window, a parking lot sign or a table tent, check them when you check the signage. A placement whose scans drop to zero overnight has either fallen down or been covered.
A setup checklist
Before printing, write the placement plan, build one page per placement that captures a phone or email, and test every code end to end. After the campaign, rank placements by matched sales and read the scan counts only as a check on whether each placement was seen.
- List every placement you would make a separate decision about, and give each one its own code and its own printed path.
- Choose static codes to a redirect on your own domain for anything printed in volume or kept for years; vendor dynamic codes for the rest, after reading what happens if the plan ends.
- Tag each destination with source, medium, campaign and content, in lowercase, from the plan.
- Build a phone-sized placement page with a form for name, phone and email, hidden fields for the tags, and a tap-to-call number for that placement.
- Scan every printed proof at its real distance, submit a test lead from it, and find that lead in the CRM with its placement in the source.
- Print the short address beside the code, and add the public placements to someone's inspection round.
- At the end of the period, export the leads and the closed sales, match them on normalized phone numbers and email, and rank placements by cost per matched sale.
- Read small numbers as small. Wait for enough sales before cutting a placement, and remember that its matched sales are a floor.
A QR code is a door, and the scan count only says how often someone looked through it. Give every placement its own door, make the room behind it ask for a phone number or email, and judge the placement by the sales whose buyers walked through it.
Questions people actually ask
- How do I track QR code scans?
- Either use a dynamic code, whose generator counts every request to its redirect, or point a code at a URL tagged with UTM parameters and read the visits in your analytics. Do both if you can, and give every placement its own code. Either way you are counting phones that opened a link, so the useful number comes later: the leads and matched sales each placement produced.
- Is a dynamic QR code worth paying for?
- Usually, for anything printed in volume or expensive to reprint, such as a vehicle wrap or a mailing. A dynamic code can be pointed somewhere new after printing and it counts scans. The cost is dependence: the code works only while the vendor's redirect does. A static code pointing at a short redirect on your own domain gives you the editing without the dependence.
- Do unique QR code scans count people?
- No. Generators estimate unique scans by device or browser, so one person scanning on a phone and a tablet counts twice, and two people sharing a phone count once. Total scans also include staff testing the print, repeat scans by the same customer and automated link checks. Treat unique scans as a rough ceiling on curious people, never as a count of prospects.
- How do I know if a QR code led to a sale?
- Make the scan land on a page that captures a phone number or email, through a short form or a tap-to-call number assigned to that placement, and record the placement as the lead's source. Then match closed sales to those leads on normalized phone and email. A sale whose buyer appears as a lead from that placement is evidence the code worked.
- Should I put UTM parameters on a QR code URL?
- Yes. Tag every destination with utm_source, utm_medium and utm_campaign, and use utm_content for the specific placement or design. Google Analytics treats values as case sensitive, so write them in lowercase from a fixed list. Then check that the tags survive any redirect and reach the form's hidden fields, because a tag that stops at the analytics tool never reaches the sale.
- Can someone tamper with my QR code?
- Yes. The FBI warned in January 2022 that criminals replace legitimate codes with malicious ones, including by putting a sticker over the original. Inspect public placements, print your web address in readable text beside the code so scanners can check where it leads, and never take payment through a scanned link.