Comment by billpg

Given the structure seems simple, what would prevent someone making their own QR with fake data and a randomly selected ID number?

If the answer is that a service can validate the data, then why not just have the ID value if its all going to be on a server?