The ultimate thing of course is: Prove the customer was in the shop and making a purchase.
And I'm sure you've also looked into whether the QR code could be generated per transaction (they could be, but does this place too high a cost-burden on the merchant and if a new device is used to display the generated codes is that going to meet local food hygiene standards for food outlets - and if existing devices are used such as printing on the receipts of their EPOS, is that accommodated by EPOS software).
We also looked into watermarking some signal from a sensor to prove that they were there, then we discovered Shopkick doing this with their noise emitter (a novel approach). We're unsure whether this is the best approach (requires another power point in the merchant, a mount point, installation, and if the emitted signal is dynamic then it requires a connection).
It's an interesting thing for sure... the best thing we've done to date is launch in a student bar with an alcohol deal, there is nothing that generates great data for security like letting compsci students hammer it with the reward of free beer. It's effectively our bug bounty... defeat our system and get a beer (or several) and strongly incentivises us to not have them defeat it.
And I'm sure you've also looked into whether the QR code could be generated per transaction (they could be, but does this place too high a cost-burden on the merchant and if a new device is used to display the generated codes is that going to meet local food hygiene standards for food outlets - and if existing devices are used such as printing on the receipts of their EPOS, is that accommodated by EPOS software).
We also looked into watermarking some signal from a sensor to prove that they were there, then we discovered Shopkick doing this with their noise emitter (a novel approach). We're unsure whether this is the best approach (requires another power point in the merchant, a mount point, installation, and if the emitted signal is dynamic then it requires a connection).
It's an interesting thing for sure... the best thing we've done to date is launch in a student bar with an alcohol deal, there is nothing that generates great data for security like letting compsci students hammer it with the reward of free beer. It's effectively our bug bounty... defeat our system and get a beer (or several) and strongly incentivises us to not have them defeat it.