QR Codes at Restaurants: How to Avoid Sketchy Links
You sit down at a restaurant. The table has no physical menu — just a small card with a QR code printed on it. You pull out your phone and point the camera. For a split second, a familiar thought flickers: Is this actually the restaurant's QR code? Or did someone stick a sticker over it?
That moment of doubt is worth paying attention to. Restaurant QR code safety isn't just paranoia — tampered codes are a real, low-tech attack that's easy for anyone to pull off in a busy dining room. This post walks through what the threat actually looks like, how to spot a fake QR code before you tap it, and how to scan QR code safely every time.
The Real Threat: QR Code Tampering Is Easier Than You Think
A QR code is just a pattern that encodes a URL. Anyone can generate one — for free, in seconds. That means anyone can print a sticker with a QR code pointing to any website they want, then walk into a restaurant and place it over the existing menu code on a table.
When you scan that sticker, you don't go to the restaurant's menu. You go wherever the attacker sent you. That could be a fake payment page designed to look like the restaurant's ordering system, a credential phishing page asking you to “log in” to claim a loyalty reward, or a site that attempts to push a malware download to your device.
This type of attack — sometimes called a QR code scam restaurant attack or “quishing” (QR code phishing) — works precisely because QR codes are opaque. There's nothing to read, nothing to verify with your eyes. You just point and tap, trusting that what you're scanning is what you think it is. The good news: a few seconds of visual inspection and one smart habit will protect you from almost all of it.
How to Spot a Fake QR Code at a Restaurant
You don't need special tools to catch most tampered codes. Here's what to look for before you scan.
1. Check for a sticker over the original
Run your finger lightly over the QR code. Does it feel raised? Can you see edges or slight bubbling around the border? A sticker placed over a printed or laminated code often has visible seams, especially in raking light. If the code is on a table tent or card that's clearly part of the restaurant's branding, but the QR itself looks like it was added later — trust that instinct.
2. Check the URL after scanning — before you open it
This is the most important habit you can build. A safe QR code scanner shows you the destination URL before opening anything. If you see tableorder-secure-payment.com instead of the restaurant's actual domain, don't tap. The URL should match the restaurant's name or a known ordering platform. If it looks off, it probably is.
3. Watch for immediate payment or personal info requests
Menus never ask for your credit card before you've ordered. If scanning a “menu” QR code immediately takes you to a payment screen or asks for your name, email, or login credentials — stop. That's not a menu. A legitimate restaurant QR code takes you to a page of food items, full stop.
4. Be wary of URL shorteners
If the URL preview shows a shortener (bit.ly, tinyurl.com, or similar), that's a flag worth noticing. Legitimate restaurant ordering systems use their own domain or a known platform domain. Shorteners hide the real destination and are a common tool in QR code phishing campaigns.
5. Look for HTTP instead of HTTPS
A URL beginning with http:// (no padlock) means the connection isn't encrypted. Any legitimate business handling your order or personal information uses HTTPS. If the browser bar shows an untrusted connection warning or a plain HTTP URL, close the tab immediately.
What a Good Scanner Shows You
Most phone cameras open QR codes immediately — scan, tap, gone. You never see the URL until you're already on the page, by which point it's too late to check.
A safe QR code scanner works differently. It decodes the code, shows you the full destination URL in a preview, and waits for you to decide whether to open it. That one pause is your entire defense against a fake QR code. You see https://restaurantname.com/menu and proceed confidently. You see http://sketchy-domain.net/login and close the app. Simple, every time.
SnapScan is built around this idea. It shows you exactly where a QR code points before opening anything — no auto-launch, no surprise browser tabs. It also works fully offline, so the decode and preview happen on your device. One-time $14.97, no subscription.
See the URL before you open it — every time.
Get SnapScan — $14.97 one-time →Try SnapScan Before Your Next Restaurant Visit
The next time you sit down somewhere new, you'll scan a QR code. Take two seconds to look at the sticker, then use a scanner that shows you the URL first. That's all it takes to sidestep the vast majority of QR code scams. SnapScan shows you exactly where a QR code points before opening anything — $14.97 one-time, no subscription.
Frequently Asked Questions
Can a QR code give my phone a virus?
Not directly — a QR code is just a URL. But if that URL takes you to a malicious website, the site could attempt to push a download or exploit a browser vulnerability. The defense is simple: preview the URL before opening. If the destination looks unfamiliar or suspicious, don't open it.
Are restaurant QR codes safe?
The vast majority are completely legitimate. Most tampered-code incidents happen at high-traffic public venues rather than your neighborhood spot. Still, it costs nothing to spend two seconds checking for a sticker and glancing at the URL before you tap — especially somewhere you haven't been before.
How do I scan QR codes safely?
Use a scanner that shows you the full destination URL before opening the link. Verify that the URL matches the business name or a platform you recognize. If the URL is shortened, if it's HTTP, or if it immediately asks for payment or personal info — close out and ask a staff member to confirm the correct code.
Ready to scan with confidence?
Try SnapScan — $14.97, one-time →