Every scan from our poster campaign showed up as organic installs. What did we miss?

That happens when the QR code points straight to the App Store or Play Store with no parameters. Give every placement its own tracking link, so three cities means at least three links, with a consistent UTM structure: utm_source=qr, utm_medium=offline, a utm_campaign naming the city, and utm_content for the placement or creative. The link has to handle three outcomes: open the app on the right screen if installed, send non-installers to the store while keeping the campaign so the first open is credited, and send desktop scans to a landing page. Use dynamic QR codes so you can change the destination without reprinting, set error correction to high, and keep codes at least 2cm by 2cm. Before printing, scan from several devices and confirm a test install lands against the right campaign. Then track scans, store views and installs per placement. Platforms compared: https://linkrunner.io/blog/deep-linking-platforms-with-qr-codes