QR code menus became commonplace fast, and most diners now scan one without a second thought. That convenience is exactly what makes table-tent codes an attractive target — see our documented restaurant menu scam case file for how this plays out in practice.
For diners: what to actually check
- Does the destination match the restaurant's actual name? A menu or ordering page hosted on a domain unrelated to the restaurant is a clear warning sign.
- Does the payment page match the restaurant's branding? A generic or mismatched design asking for full card details when a simple tap-to-pay would suffice is worth pausing over.
- Is the code physically consistent with the rest of the table material? A different paper stock, print quality, or slight misalignment can indicate a sticker placed over the original.
If anything feels off, running the code through CheckThisQR takes seconds and costs nothing.
For restaurant owners
Table-tent and menu codes are specifically called out in our business QR safety guide as a high-exposure category — they're easy to reach, often unattended for hours, and directly touch payment flows. The single highest-leverage fix: laminate or embed the code into the printed material itself rather than using a separate adhesive sticker, making it meaningfully harder to convincingly overlay.
Red flags worth teaching your staff
- A customer mentions the menu link "looks weird" or asks to pay differently — treat this as a signal worth checking that table's code immediately, not just an isolated complaint.
- A code that looks slightly raised, bubbled, or has visible adhesive residue at the edges.
- Any table-tent or sign that seems to have been recently touched or repositioned outside normal cleaning routines.
How a menu-code scam typically plays out
A diner scans a table-tent code expecting the menu. The page that loads asks for a name, email, and card number to "place an order" before showing any food. The real restaurant never sees the order, and the card details go to someone else. The tent had been swapped for a look-alike, and nothing about it looked unusual to staff or customers. This is a composite example to show how the scam works, not a report of a specific incident.
Menu codes are attractive targets because diners are relaxed, distracted, and expecting to scan. An attacker either replaces the physical code or points a compromised link at a clone page that captures order and payment details.
Extra red flags for diners
- A menu page that asks for a card number before showing any food.
- A domain that does not match the restaurant's known website.
- Pop-ups or countdown timers.
- A code that looks newly printed or styled differently from the rest of the restaurant's materials.
If the restaurant has a known website or app, open it directly instead of scanning. You can also photograph the code and check it before opening anything — see how to scan from a photo.
If you already scanned and entered something
Act quickly, but calmly:
- Close the page and do not re-enter anything.
- Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
- If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
- Let the restaurant know so staff can check the other tables.
- Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.
For a fuller walkthrough, see I scanned a malicious QR code — what now?