The restaurant QR code isn't always what you think.

The sticker technique

The method is disarmingly simple. A criminal walks into a restaurant, spots the QR code stands on the tables or at the entrance, and sticks a freshly printed cover sticker on top: with their own QR code. The whole operation takes less than thirty seconds per table.

The fake page that opens is a near-perfect replica of an ordering or payment page: the right logos, the right brand colours, sometimes even the restaurant's name. The customer, convinced they're browsing today's menu, enters their bank card details on a fraudulent website.

The technique is not limited to restaurants: Cybermalveillance.gouv.fr, the French government's cybercrime assistance platform, also reports fake QR codes stuck on parking meters and electric vehicle charging stations.

Restaurants that switch to digital menus without physical protection (engraved QR codes, locked holders) are prime targets. Small establishments that self-print their stands on ordinary paper are the most vulnerable.

How to spot it

Before scanning, physically inspect the QR code. Fake stickers are often slightly misaligned, with edges that overlap or a print quality different from the rest of the restaurant's materials.

Use a QR reader that displays the full URL before opening the link. The native iOS Camera app and built-in Android readers generally show the URL, take a moment to read it. Attackers use typosquatting: 'carte-restaurant-lyon.com' instead of the venue's official website.

Be especially wary if the page that opens requests bank card details just to view a menu. No legitimate restaurant gates menu access behind a payment.

If in doubt, ask a staff member directly to show you the menu card or the QR code displayed in their admin interface: not the one on the table stand.

What Trasimène does

Trasimène includes a QR code scanner. Every link read by this scanner is checked by our servers before it opens: against the lists of phishing and malware sites maintained by Trasimène, against Google Safe Browsing, and by following any redirects to their final destination.

If the link is recognised as dangerous, it does not open: an alert appears, and you decide whether to open it anyway. The domain's registration date, when known, is shown to help you judge, but it does not count towards the verdict.

This check goes through the app's scanner: open it before pointing at the QR code. A QR code read with the phone's camera app is not checked. If Trasimène's optional VPN is on, it spots afterwards a visit to a site already in our lists and flags it to you in the app. It does not block the page itself: only Quad9, the Swiss service it hands name resolution to, filters out on its side the malicious domains it knows.

If in doubt, ask the restaurant to show you the QR code on their admin interface or an official document: not the table stand.

Vigilance is still the first line of defence. A quick look before scanning, reading the URL before you type, asking a question when in doubt: these simple habits are enough to defeat the vast majority of QR code attacks. And with the right security app, there's no reason not to automate them.

Sources

Trasimène: Mobile security

Protect yourself against QR phishing

Download Trasimène →