I scanned a QR code menu at a restaurant table and it asked me to enter payment details before showing the menu — is that normal?

QR code menus normally just link to a webpage displaying the restaurant's food and drink options, with payment, if handled digitally at all, occurring separately at the end of the meal through a legitimate point-of-sale system or a payment link sent by staff. A fake QR code sticker placed over a table's genuine code can redirect to a fraudulent page designed to look like a menu or ordering system but that requests card details upfront, supposedly to 'start your tab' or 'reserve your table session.'

This scam relies on the same principle as other quishing attacks — a QR code hides its destination, and diners often assume any code on a restaurant table must be legitimate since it's presented in an official-looking context by the business itself. Because ordering and paying through a phone has become normalized in many restaurants, a request for payment details before even seeing a menu may not immediately strike a distracted diner as unusual.

If a scanned restaurant QR code asks for payment details before displaying any actual menu items, it's best to stop, ask a staff member directly whether the code is legitimate, and avoid entering any card information on the page until confirmed.