What is QR code fraud (quishing)?

It is when scammers stick fake QR codes over real ones to redirect users to fraudulent sites. In restaurants, the QR menu labels on tables are targeted; customers are led to fake payment pages where their card details are stolen.

How can restaurants protect themselves from fake QR stickers?

The most definitive method is removing the code from the table. In Flowisma Resto, the waiter shows the table-specific QR code on their own screen; there is no physical code left to sticker over. If you use printed codes, inspect the labels regularly and verify the domain.

What happens when the QR code on the waiter's screen expires?

The code renews itself roughly every 10 minutes; a customer scanning an expired code sees a polite notice, and the waiter shows a fresh code with one tap. Orders already placed and the open bill are not affected in any way.

Do orders or bills get mixed up when the code renews?

No. The bill is tied to the table session, not the QR code. No matter how many times the code renews, all orders accumulate on the same table's tab and appear on a single list until the bill is paid.

Does secure QR require extra devices or metal plates?

No. The phones or tablets your waiters already use are enough; the QR code is shown on screen. There is no need to engrave metal plates or modify tables, and no extra cost.

QR Code Fraud: How to Protect Your Restaurant from Fake QR Stickers

A type of fraud that has been making headlines lately directly concerns café and restaurant owners: scammers stick their own fake QR codes over the QR menu labels on tables. When a customer sits down and scans the code, they are taken not to the menu but to a fake payment or card-details page prepared by the scammers. Internationally, this attack is known as quishing (QR phishing).

In this article we explain how a quishing attack works, the damage it can do to your business, and the secure QR approach that makes it possible to offer a QR menu without sticking a single label on a table.

How Does QR Code Fraud (Quishing) Work?

The attack is disturbingly simple:

The scammer walks into the venue like a customer at a busy hour.
They stick a fake label, visually identical, over the real QR label on the table.
Subsequent customers scanning the code land on a fake site instead of the real menu.
The fake site asks for card details, a deposit payment, or personal data.

When customers lose money, they naturally blame the venue. So the damage is not only the customer's; your reputation, Google reviews, and customer trust are directly targeted too.

Why Common Solutions Fall Short

The first solutions businesses came up with are costly and cumbersome:

QR codes engraved on metal plates: A sticker can still be placed over them; they are merely harder to remove. And every table carries printing and mounting costs.
Having staff regularly inspect labels: Not sustainable during a busy service; a single missed label is enough.
Abandoning QR menus altogether: Throws away the speed, updatability, and ordering advantages of a digital menu.

The root of the problem is this: any code fixed to a table is physically exposed. As long as the code sits on the table, something can be stuck over it.

The Secure QR Approach: Your Waiter Presents the Menu

Flowisma Resto solves this problem with a fundamentally different method: the QR code is not on the table — it is in the waiter's hands.

The waiter selects the table on their own phone or tablet panel, and a QR code specific to that table appears on their screen. The customer scans the code directly from the waiter's screen and reaches the menu linked to their table. There is no physical code to sticker over.

This approach has a critical second layer: the code shown on screen is not permanent. It is generated on the spot and renews itself roughly every 10 minutes. Even if someone photographs the waiter's screen and copies the code, the copy becomes invalid shortly after. A customer scanning an expired code sees a polite notice — asking the waiter for a fresh code is all it takes.

But Won't the Bills Get Mixed Up?

The first question restaurateurs ask at this point is usually: if the code keeps renewing, won't orders and bills get mixed up?

They won't. The code's expiry only protects the initial opening of the menu; the bill itself is tied to the table session. Whether the code is renewed once or five times for the same table, every order lands on that table's open tab. The soup ordered in the first round and the dessert added an hour later appear on a single list, in a single total, at the register. When the bill is paid the session closes; the next party at that table starts with a clean tab.

What About My Printed QR Codes?

Secure QR does not disrupt your current setup. Your printed QR codes keep working; presenting from the waiter's screen is not an obligation but an extra security layer. Use both methods side by side, or move fully to on-screen presentation over time. No extra hardware, metal plates, or printing costs required.

A Practical Checklist for Your Venue

Inspect the QR labels on your tables regularly; watch for bubbled or double-layered stickers.
Make sure the menu address your customers land on is your own domain.
Brief your staff about quishing; have them remove suspicious labels immediately.
Ask your QR menu provider whether codes can be dynamic and time-limited.
Always collect payments at the register or through channels you control; use a system whose menu page never asks for unexpected payments.

Conclusion

The QR menu is one of the most practical steps in restaurant digitalization; but any code fixed to a table remains open to physical tampering. Moving the code off the table and onto the waiter's screen leaves scammers no surface to sticker. Time-limited, self-renewing codes make copying pointless. Flowisma Resto offers this secure QR approach as standard, together with the bill-integrity guarantee — at no extra cost.