Qrunto blog

Fake QR code stickers: how to protect your restaurant and your customers

Scammers paste fake QR codes over real ones to steal card details. Here's how quishing works, why restaurant tables are a target, and a five-minute weekly check to catch it.

29 October 2026 · 3 min read

A customer sits down, scans the code on the table, and lands on a page asking for their card details to "open a tab". The page isn't yours. Someone stuck their own QR code over yours on the way past.

This is called quishing, phishing with a QR code, and it's growing. The US Federal Trade Commission warned in December 2023 that scammers were pasting their own codes over the ones on parking meters. In the UK, Action Fraud received 784 reports of QR code scams between April 2024 and April 2025, with almost £3.5 million lost, according to Which?.

Why restaurants and cafés are a target

• Customers trust codes on your tables. They scan without a second thought, because the code is in your restaurant.
• The codes are within easy reach. Table tents, window posters and counter stands can be covered in seconds by anyone walking past.
• Payment at the table is normal. A fake "pay your bill" or "order here" page doesn't look out of place.
• Nobody checks. Staff see the same table tents every day and stop noticing them.

Most fakes are stickers placed over the real code, but some scammers swap whole table tents or put up a "Scan for free Wi-Fi" sign that leads to a fake login page.

The five-minute weekly sticker check

Pick a quiet time, like before opening on a Monday, and walk round with your phone:

1. Look before you scan. Is there a sticker on top of the printed code? Is a corner lifting, or is the code a slightly different size, colour or finish from the rest of the print?
2. Scan every code: tables, windows, the counter, the toilets and the car park if you have one. Check the address your phone shows before opening it. It should be your website or your QR provider's address, nothing else.
3. Count your codes. A code you didn't put there, like a new "free Wi-Fi" sign, is a warning sign even if nothing is covered.
4. Check the outdoor ones twice as often. Window and pavement signs are the easiest to tamper with.

Make your codes harder to fake

• Put your logo or name in the middle of the code and print "Scan for our menu" with your business name next to it. A plain black sticker on top stands out.
• Print the short address under the code, so customers and staff can compare what their phone shows with what's printed.
• Use holders, not loose cards. Codes behind acrylic stands or laminated into the menu are much harder to cover than paper tents.
• Don't take payment through a QR code unless it goes to a payment page your staff can recognise. Many UK councils now tell drivers they never take parking payments by QR code. "We never ask for card details through a QR code" is an easy promise to make your customers too.
• Tell your staff what your codes look like and what they should open, and ask them to mention anything odd.

If you find a fake code

1. Photograph it where it is, then remove it.
2. Check where it pointed without opening it. Take a photo of the code and use our free QR code safety checker, which shows the address and whether Google lists it as dangerous, without opening the page.
3. Report it. In the UK, report it to Action Fraud (in Scotland, Police Scotland on 101). In the US, report it to the FTC at ReportFraud.ftc.gov.
4. Warn your customers if it may have been there a while: a short post on your social media and a sign at the till. Anyone who entered card details should call their bank using the number on the back of their card.
5. Check the rest of your codes straight away. Scammers rarely stop at one.

How Qrunto helps

Every Qrunto code carries your logo or initials in the middle, so a fake is easier to spot. Every link is checked against Google's list of dangerous sites when you save it and every few days after that. If a link turns unsafe, customers see a warning page instead of the page itself. And customers can report a suspicious Qrunto code straight from the page it opens.