Is a QR code on a restaurant table safe to scan?
Usually yes, but fraudsters sometimes place fake QR stickers over legitimate menu codes. Check that the sticker looks original and verify the URL before entering any personal details.
Last reviewed: 1 August 2026
Explanation
Restaurant QR menus became ubiquitous after the pandemic and are generally safe. However, scammers place fraudulent QR code stickers over genuine ones, directing diners to phishing pages that mimic payment or loyalty reward pages and collect card details. The attack costs almost nothing — a sheet of printed stickers — and works because a QR code is unreadable to humans: you cannot see where it points until you have already scanned it.
Before scanning a table code, look at whether the sticker appears to be placed over another, and whether the label is professionally printed and consistent with the restaurant's branding. After scanning, the moment of protection is the URL check: the address that opens should match the restaurant's real domain or its known menu provider, not a lookalike or a random shortened link. A menu needs no permissions and no personal data, so a scanned page that asks you to log in, download an app, or 'verify' a card has already told you what it is.
Some venues do use QR-based ordering and payment legitimately, which blurs the line — but in those cases staff can confirm the system, and the page will sit on the provider's proper domain. When in doubt, ask for a physical menu or order with a member of staff, and if you find a sticker layered over the original code, tell the restaurant so they can remove it before another table scans it.
Common red flags
- QR code sticker is placed on top of or covers another code
- Sticker looks different from other branded materials in the restaurant
- Scanned URL does not match the restaurant's known domain
- Page asks for card payment before you have received or ordered food
What to do now
- Inspect the QR code physically before scanning
- Check the URL that opens and close if it looks unfamiliar
- Alert staff if you suspect a sticker has been placed fraudulently
- If you entered card details on a suspicious page, call your bank immediately
Frequently asked questions
Should I use a QR code scanner app with a preview feature?
Yes — scanner apps that display the destination URL before opening it give you a chance to check whether the link looks legitimate before proceeding.
Some restaurants genuinely take payment through a QR code. How do I tell those apart?
Legitimate QR ordering runs on a recognisable provider domain and staff can confirm the system is theirs. If the payment page appeared from a sticker no one can vouch for, or the domain looks unrelated, pay a member of staff instead.
I entered card details on a page from a table QR code. What now?
Contact your bank immediately to block the card and dispute any charges, and tell the restaurant so they can check their codes and warn other customers. Watch your statements for small test transactions.