Are QR Code Menus Safe in 2026? What Restaurants and Diners Should Know About Quishing

A guest sits down, sees the code on the table, and scans it without a second thought. That reflex took about five years to build and it’s now close to universal.

It’s also the whole business model of a scam called quishing, QR code phishing, and the numbers stopped being small a while ago.

The good news, which most coverage skips, is that the risk depends enormously on what the code was supposed to do. A tampered code over a payment screen is genuinely dangerous. A tampered code over a menu is mostly an annoyance. That distinction is worth understanding before you decide anything about your tables.

The Scale

Research from Keepnet Labs, a security awareness firm, found QR codes in roughly 12% of phishing attacks in 2025, and 68% of quishing attacks targeting mobile users, which makes sense, since scanning is a phone habit by definition.

Government agencies have noticed. The Federal Trade Commission warned consumers that scammers place their own codes over legitimate ones, including on parking meters, and send QR codes by text and email to push people to fake sites. The IRS included QR-code scams in its 2026 Dirty Dozen list of tax scams.

Why It Works: The Verification Gap

With a suspicious email you can hover over a link, read the domain, notice something’s off. A QR code hides its destination inside a pattern your eye can’t read. There’s no sender to doubt, no URL in sight until you scan, and the whole interaction takes about four seconds on a phone.

Attackers didn’t invent a clever technology. They found a habit.

What It Looks Like in the Physical World

The version restaurants care about is physical quishing: a printed sticker placed over a legitimate code. The FTC’s parking-meter example is the classic case, and the same trick works on table tents, window decals, and hotel room cards.

There’s a cost restaurants rarely think about, and it isn’t the fraud. It’s trust. Once guests start wondering whether the code on your table is really yours, some of them stop scanning anything. For a restaurant, that’s the real exposure: a dining room full of people who’ve decided scanning is a bad idea.

The Distinction That Actually Matters

A QR code is just an encoded web address. It can’t steal anything on its own. Everything depends on what’s at the other end, and specifically on whether a scammer can build a convincing fake of it.

• A code tied to ordering and payment is a high-value target. The guest already expects to enter card details, so a cloned checkout page slides past their skepticism.
• A code tied to a view-only menu gives an attacker very little. There’s no card field to fake, no login to harvest. A swapped link shows the wrong page or an ad: irritating, occasionally a malware attempt, but not the thing that empties an account.

You can’t stop someone from slapping a sticker on a table. You can decide how valuable that sticker is to them.

That’s a fair frame for looking at MenuOnGo, which is a menu display by choice: no ordering, no payments, nothing to type in behind the scan. Your point-of-sale handles the transaction, where the security controls belong. And every MenuOnGo menu lives at a recognizable address on menuongo.com with your restaurant’s name in it, so a guest whose camera previews the link before opening it can tell at a glance that it’s the real thing. The free QR code generator on the site will make you a fresh code whenever you need one.

What Restaurants Should Do

• Inspect your table codes weekly. Look for raised edges or a sticker sitting slightly proud of the surface.
• Use tamper-evident stands or printed tents, not loose stickers that are trivial to cover.
• Avoid QR generators with expiring redirects. Some switch off the destination when a trial ends, and a code printed on 80 tents can quietly start pointing nowhere, or somewhere someone else controls.
• Brief your staff. A guest asking “does this look right?” deserves a confident answer.
• Keep some printed menus. It takes the pressure off anyone who’d rather not scan today.

What Diners Should Do

• Preview the address before you tap through. Most phone cameras show it first. The FTC’s first piece of advice is exactly this: check the URL for misspellings or swapped letters.
• Never enter card details or a password on a page you reached from a table code. Pay through a server or a system you already trust.
• Look at the code itself. A sticker on top of another sticker is the tell.
• Report it to the FTC at reportfraud.ftc.gov or the FBI’s Internet Crime Complaint Center at ic3.gov.

Risk by QR Code Type

What the Code Does	What a Scammer Can Realistically Get	Relative Risk
View-only digital menu	Little of value; no card or login fields	Low
Wi-Fi access code	Minor; network access at most	Low
Ordering, no payment	Order details, some personal information	Moderate
Ordering plus payment	Full card and billing details	High
Parking, bill, or invoice payment	Full card and billing details	High
Anything asking for an SSN or bank login	Identity theft exposure	Severe

Frequently Asked Questions

What is quishing? Quishing is QR code phishing: a scam that hides a malicious link inside a QR code, often by placing a fake sticker over a real one, to send people to a page built to capture personal or financial information. Keepnet Labs found QR codes in roughly 12% of phishing attacks in 2025.

Are QR code menus dangerous to scan? A view-only menu code carries relatively low risk because there’s no payment page or login for an attacker to fake. The high-risk codes are those tied to payment or checkout.

How can I tell if a QR code has been tampered with? Look for a sticker over another surface, raised or peeling edges, or a code that looks newer than everything around it. Then preview the address before opening it and check for misspellings, as the FTC recommends.

What should a restaurant do if it finds a fake QR code on a table? Remove it, check every table, window, and sign, tell staff, and report it to the FTC or the FBI’s IC3. Telling guests plainly usually does less reputational damage than silence.

Does removing ordering and payment from a QR menu reduce risk? Meaningfully. A code that leads only to a menu offers no card entry and no login to harvest, which makes tampering with it far less profitable and less likely.

---

Sources: Keepnet Labs, Federal Trade Commission, Internal Revenue Service, FBI Internet Crime Complaint Center. Images: Pexels (free to use). Data current as of October 2026.