I'm creating a rewards app that relies heavily on a check-in feature. Essentially, if the user checks in it adds to the users "check in count", the more they get the better the rewards such as a discount. I'm trying to figure out the best way for customers to check in that is secure (avoids cheating/spoofing), simple for the customer as well as simple for participating staff (waitresses, cashiers, etc.), and scalable (I can't set up expensive technology in every participating location).
What I've considered so far:
Geolocation - The simplest option, the phone checks if it is in the location of the store/restaurant, if so it adds to the check in count and the user can just show the count to staff. However, geolocation is easily spoofed, a user could sit at home and fake a check in every day until they have the best discount and then go in.
User generated code - The user could generate a unique code on their phone while in the store/restaurant. They could then show the code to the staff who could type it into their own portal to verify the users code against the server which in turn rewards the user their check-in. The benefit of this is it's very secure as the business staff gets to validate the code, the code is unique to the user/instance so it can't be shared, and is easy for the customer they just click "generate code". However, it is time consuming and burdensome for the staff to type in customers code, if its a busy day it could be a deal breaker.
Customer name - About the same as user generated code, except easier for the staff to remember if they have to walk back to the register to type it in
Staff generated code - The staff could open their web portal every morning at the start of business and have a unique code generated for the day. Something easy to remember like "robinhood", "triangle", etc. Then whenever a customer needs to check in the staff can just tell the customer the code of the day and the customer can type it in. This has the benefit of being simpler for the staff, they could generate the code once a day and not have to input anything. It is more difficult for the customer, but they'd be more accepting as they are the ones getting the discount. The security is decent, it verifies that the user actually used the real code supplied by the staff, however it could just be tweeted out and shared. The staff would be able to reset/request a new code whenever they want to combat this but it wouldn't solve it completely and would again add work to the staff.
QR code - I could give the business a QR code poster/sticker, the user would have to scan it to check-in. However, they could just take a picture and scan it from wherever.
RFID - An RFID for the phone to read would be harder to spoof that QR, however iPhones don't read passive RFID and active RFID would be quite expensive to distribute to all these businesses.
Note: In this instance simplicity is a factor. I've heard of technology such a ultrasound speakers projecting at a certain frequency that can be picked up by phones to verify location. While I'm sure that could work that is well beyond the scope of what I'd like to/know how to do.