QR code phishing: fake QR codes that send people to fraudulent websites to steal card details or logins.

How can I tell if a restaurant QR code is fake?

Check the web address before opening it, look for stickers placed over other stickers, and be wary of any menu that asks for payment or login just to view dishes.

How can restaurants prevent fake QR codes?

Use embedded or tamper-evident codes, check them at every opening, brand them clearly and make sure the real menu never asks for payment upfront.

What should a guest do after scanning a fake code?

Close the page, do not enter details, tell the staff, and contact their bank immediately if they entered card information.

Should restaurants use dynamic QR codes for security?

Dynamic codes let you redirect quickly if something goes wrong, but they also create an account that must be protected. Static codes pointing to your own domain avoid that dependency. Either way, physical checks of the codes on tables matter most.

QR code menu security: how restaurants stop fake codes and quishing

By the Menulta editorial team · Facts checked 15 October 2026 · Updated 15 October 2026

The short answer

The main security risk with QR menus is 'quishing': someone sticks a fake QR code over yours that sends guests to a phishing page asking for card details or logins. Restaurants reduce the risk by using tamper-evident or embedded codes, checking codes regularly, keeping the menu on a recognisable web address, never asking guests for payment or personal details just to view the menu, and telling staff what to look for.

What quishing is

Quishing combines QR codes and phishing. A criminal prints a QR code that leads to a fake website, then places it where people expect to scan a legitimate code: parking meters, posters and, occasionally, restaurant tables. Guests who scan may be shown a page that looks like a menu or payment page and asks for card details, a login or an app download.

Police and consumer agencies in several countries have warned about fake QR codes on parking machines and in public places. Restaurant menus are a less common target, but outdoor terraces and street-facing windows are exposed.

Making codes harder to tamper with

Embed codes in the table surface, engraved plates or acrylic stands rather than loose stickers.
Use tamper-evident stickers that tear or show a pattern if peeled.
Print your logo and restaurant name next to the code, so a plain overlay looks out of place.
Check every code at opening: is it the original, and does it open your menu?
Replace codes on outdoor tables and windows more often, and inspect them after busy nights.

Designing the menu so fakes stand out

Guests can only spot a fake page if they know what the real one looks like. Keep the menu on a stable, recognisable address, ideally on your own domain or a well-known menu provider. Make sure the real menu never asks for a login, an app download or card details just to view dishes. If your system takes payments, the payment step should come only after ordering and use a recognised payment provider.

When a page that claims to be your menu asks for payment upfront, guests have a clear signal that something is wrong.

Training staff

Staff should know what your codes look like and where they are placed, and should check them as part of opening and closing routines. If a guest says the menu asked for card details or looked strange, staff should check the code immediately, remove any fake sticker, and warn other tables. Keep a few spare official codes so a damaged or replaced one can be swapped on the spot.

What to tell guests

A short line next to the code helps: 'Our menu opens at yourrestaurant.com and never asks for payment to view it.' It costs nothing and gives guests a simple check. If a guest reports a problem, thank them, check the code, and if they entered card details on a fake page, advise them to contact their bank straight away.

Other security basics

Protect the account that controls your menu with a strong, unique password and two-factor authentication where available. Limit editing access to the people who need it. If your codes are dynamic, protect the dashboard that controls where they redirect, because anyone with access could point every code at a different site.

A weekly security routine

Security does not need to be complicated. Once a week, a manager walks the room and terrace with a phone and scans every code, checking that each opens the real menu at the expected address. Look for stickers with raised edges, codes that look slightly different in colour or size, and any new codes that were not there before. Note the date of the check.

At the same time, check who has access to the menu account and remove anyone who has left. Review the redirect settings if your codes are dynamic. These ten minutes catch almost every problem before a guest does.

Sources

This guide is general information, not medical or legal advice. Guests with an allergy should follow their doctor's advice. Operators should confirm their own setup with their food safety adviser or local authority.