Industry guide
QR codes for public transport
Transport QR codes are scanned by people in a hurry, often with poor signal underground, and on surfaces that are prime targets for fraudulent stickers. Size for a 1–2 m platform distance, and make the real domain visible.
Speed and signal
A passenger scans while a bus is approaching. Anything that takes more than a couple of seconds to load is not read. Keep linked pages under 200 KB, server-rendered, and cached.
Underground stations frequently have no data. Live departure boards behind a QR code are useless where there is no signal — put the timetable behind it as well, or make the page work from cache.
Tampering is the main risk
Bus stops, ticket machines and parking meters are the classic quishing target: a sticker over the real code leading to a fake payment page. This is a widespread, real-world fraud, not a theoretical one.
Defences:
- Print the real domain in text on the same panel, large.
- Tamper-evident laminate that visibly damages when peeled.
- Scheduled inspections as part of the cleaning round.
- Public notice stating the only domain your organisation uses for payments.
Sizing
Platform and shelter signage is read from 1–2 m: 10–20 cm of code. Codes at 3 cm on a bus-stop flag are not scanned.
What to link
| Use | Notes |
|---|---|
| Live departures for this stop | The stop id in the URL |
| Timetable PDF fallback | Works when the live feed does not |
| Accessibility information for this station | Step-free routes, lift status |
| Report a problem | Asset id prefilled |
| Ticket purchase | Only from a verifiable official domain |
Prefilling the stop or asset id is what makes these worth scanning — a code that opens a generic homepage is not.