In a reported August 2026 case, a diner scanned a restaurant menu QR code, opened the linked page and accepted a pop-up; an unwanted premium subscription was then activated. This is one way quishing—phishing that uses QR codes—can turn a familiar menu scan into a risky interaction.
How a restaurant QR-code scam can work
A QR code encodes a destination, but its pattern alone doesn’t tell you whether that destination is trustworthy. A substituted or deceptive code can lead to a fake menu or payment page, ask for personal or financial details, or present a misleading prompt. The risk depends on the destination and what happens next; scanning a code alone doesn’t establish that a phone has been compromised.
In the reported restaurant case, the diner opened a link and accepted a pop-up before the unwanted premium subscription was activated. A separate parking-payment example shows a fraudulent sticker being peeled from a sign to reveal the code beneath.
What the email attack figures measure
Microsoft Threat Intelligence reported 7.6 million email-based QR phishing attacks in January 2026 and 18.7 million in March, a 146% increase between those monthly counts. The figures track attacks delivered through email, while the reported restaurant case involved a physical menu code.
PDF attachments accounted for 65% of the QR-code attacks in January and 70% in March. QR codes embedded directly in email bodies rose 336% in March and represented 5% of QR-attack volume at the end of the quarter.
Check a code before you continue
- Look for a sticker that appears added, lifted or placed over another code.
- Preview the destination address before opening it.
- If the code or destination seems questionable, ask restaurant staff to confirm it or use the restaurant’s known official website or app.
If you scanned a suspicious code
Stop using the page and don’t enter more information. If you submitted a password, change it through the genuine service. Monitor your financial accounts and report suspicious activity to the relevant business or financial institution. If you downloaded a file, run a security scan.
