Why the member QR code refreshes itself

A paper stamp card has one security feature: a rubber stamp that is slightly hard to copy. Digital cards start from a worse position, because anything shown on a screen can be photographed perfectly.

So the member code in RayPass is not a fixed identifier. It is a short-lived token that the app regenerates on a timer.

What that changes

A screenshot expires. Send your code to a friend and by the time they reach the counter it has already rolled over. The stamp lands on your card or on nobody's.

A leaked code is not an account. The token identifies a membership for a few seconds, nothing more. It is not a password, it cannot be replayed later, and it does not carry your email address.

Staff never type anything. The scanner reads the current token, the server checks it is still valid, and the stamp is applied. There is no member lookup and no chance to add a stamp to the wrong card.

What the business sees

When a code is scanned, the merchant receives the member ID, display name and avatar — enough to confirm they are stamping the right person. They do not receive the email address, the password or any location data. That boundary is written into the Privacy Policy and enforced by row-level security in the database, not just by the app.

Why it matters for the maths

Fraud is not usually dramatic. It is a regular customer stamping themselves twice, or a group sharing one card between four people. Small leaks change the economics of a programme quietly: your completion rate looks great and your margin does not.

Rotating tokens remove the easiest version of that problem, so the numbers in your dashboard describe real visits.

The trade-off we accepted

Rotating codes need the app open and, ideally, a connection. For the moments where that is inconvenient, the membership pass in Apple Wallet or Google Wallet is there as the slower, sturdier path. Two mechanisms, one card — and neither of them is a photograph someone took last Tuesday.