If you're at the point of asking permissions, might as well grab the location data as well. You could then verify that the person hitting the QR code is actually on your front step which would eliminate all of the false positives like the replay attacks, copies being used in other locations, etc.