QR and barcode identification is the scan route: the member opens their pass, the till scans the code, and the point of sale looks up the member. Apple Wallet and Google Wallet both render QR codes, Aztec codes, PDF417 and Code 128 barcodes on passes, so the format can match whatever the merchant's scanners read best.
Its strength is universality. Nearly every retail counter already has a scanner, either a handheld at the till or a camera in a self-checkout, and scanning a pass works on all of them with no new hardware, no terminal integration and no key exchange. For many programs this makes scanning the fastest route to being live everywhere, including franchise estates with mixed hardware.
The code's content matters as much as its format. A static member number is simple and fine for most loyalty programs; higher-stakes passes such as tickets or memberships can carry rotating or single-use codes to prevent screenshots being reused. What the code encodes is defined in the pass and resolved by the program's backend at scan time.
QR/barcode and NFC identification are equals, not a hierarchy. NFC shines where payment terminals support identification in the payment tap; scanning shines where scanners already exist. A wallet pass carries both, the hardware at each till decides which is used, and members never need to know there was a choice.