At Reflect Festival, on 15–16 May 2025, surrounded by founders, tech enthusiasts, and people trying to pitch their startup in under 30 seconds, we at Malloc decided to run a little social experiment.
We printed 300 identical cards with just one message: “SCAN AND WIN” and a QR code. That’s it. No brand. No logo. No clue what was to be won. No app download prompt. No QR code disclaimer. No obvious source. Just raw, unfiltered curiosity bait.
Then, we quietly spread them across the Reflect Festival venue — on tables, in bathrooms, near food trucks, slipped into tote bags, and even taped a few to lampposts. No one approached anyone. No one explained anything. The cards had to speak for themselves. And speak they did — by the end of the event, 235 people had scanned the QR code.
Our goal?
To test how easily people share personal data — and to highlight just how urgently tools like Malloc Privacy & Security VPN are needed to protect users from phishing, spyware, and shady data collection.
The results
The results? Honestly, a little terrifying.
The numbers:
- 🔢 235 people scanned the QR code
- 📝 103 submitted full personal data
- 🎯 That’s a 43.8% conversion rate — better than many funded startup landing pages.
But here’s what really blew our minds. Not only did people eagerly share their names, phone numbers, and corporate emails — many cheerfully handed over their home addresses, birthdates, and even answered the all-important question: “Do you have a dog?” All from a random QR code with no context.
But wait — they downloaded a file too?
Yep. As a final touch, we offered an innocent-looking calendar file. 58 people downloaded it. That’s 56.3% of the form submitters who willingly installed a file from an unknown source.
Let that sink in.
Why we did this (and what Malloc does)
At Malloc, we build privacy and security tools — including a mobile security app that scans for spyware, blocks trackers, and defends against phishing attempts. You can read more on our mobile security platform page.
We didn’t do this experiment to shame anyone. We did it to illustrate the problem: people are vulnerable to the simplest tricks, even tech-savvy folks at innovation festivals. That’s why apps like Malloc exist — to reduce that risk when curiosity (or tiredness, or FOMO) gets the best of us.
No personal data collected during the experiment was retained beyond the purpose described here.
Relevant tags:
Published on Medium
