The QR menu on your table looks harmless, but could it secretly steal your financial information

QR code

QR codes were meant to make life smoother. No waiting for a printed menu at a restaurant, no flipping pages, no calling out to staff for the bill. Just scan, tap, and you’re done. But that tiny square on your table could now cost you more than your dinner, security experts and officials are warning.

According to a report by the New York Post, scams using QR codes have spiked sharply in late 2025, and the method has a new name: quishing attacks. The word is new, but the scam is not complicated. Fraudsters create harmful QR codes and paste them over real ones, or place them on posters, flyers, parking meters, and even billboards. When someone scans these codes, instead of opening a menu or a genuine payment page, the link takes them to a fake website that looks believable. That fake page can steal names, phone numbers, emails, banking details, passwords, and in some cases, can even install damaging software on your phone.

The worrying part is how simple this scam is to execute. Scammers don’t need to break into systems or hack networks. They just need to print a code and stick it over an original one. There are no obvious signs for most users to notice. No spelling mistakes, no suspicious email sender, no pop-up warnings. To the average customer, it looks like the restaurant or company placed it there.

Security researchers say this isn’t targeting just one generation. IBM has reported that older adults, who are often more vulnerable to traditional email scams, may also fall for QR code scams. But younger people are equally exposed. Millennials and Gen Z scan QR codes without hesitation now, especially at restaurants, hotels, clinics, doctor’s offices, shipping updates, and delivery tracking links. Scammers know this, and they know people rarely pause to verify a code that looks official.

IBM has urged consumers to watch for physical signs of tampering. A QR sticker that looks uneven, poorly pasted, bubbled, layered, or placed over existing print should immediately raise suspicion. Officials also warn users to avoid scanning QR codes that arrive randomly in messages asking to verify payments or update delivery status, especially if you never requested them.

Another big red flag is when a QR link asks for extremely sensitive information like your banking PIN, full card number, or account password. Real companies never ask for that kind of detail through QR pages. If you see it, close the page instantly.

Experts say QR codes were never built with security as the priority. They were built for convenience and speed. That speed and simplicity is exactly what scammers love because it gives them maximum reach with minimal effort.

The safest approach for consumers right now is simple. Scan only when you trust the source. If something looks pasted or out of place, don’t scan it. A menu should not turn into a moment of panic or identity theft.

The camera is not the threat. The code is. And a safe scan starts with a second thought.