How to Check Restaurant QR-Code Table Signs: Overlay Stickers, Unfamiliar URLs, and Mismatched Table Numbers

Restaurant QR-code table signs should be checked for their appearance, URL, and corresponding table number. A sign can look intact but be at the wrong table, and a page that opens may not lead to a destination approved by the restaurant. If you find anything unusual, suspend use and have staff provide the menu in person so customers aren’t put at risk while the issue is checked.

A security article published by INCIBE on 2022-6-30 advises checking the destination URL before opening a QR-code link, being wary of suspicious addresses and downloads, and not providing private information to an unverified page. This article discusses existing guidance; it is not a report of a new incident.

Keep a controlled reference copy for comparison

Have a designated manager keep a reference of the current table-sign design, table numbers, and expected URLs, and record where newly printed and replacement signs came from. The reference should not include admin account details, keys, or other secrets. Staff can check the service entry point without needing management credentials. Don’t use an image from an unknown chat as the basis for reprinting signs.

Three types of issue, each requiring different checks

• Extra overlays or unfamiliar stickers: Stop using the sign, record its location and appearance, and have the manager retain any necessary evidence. Don’t simply peel it off and put the sign back into use.
• The URL preview differs from the reference: Don’t continue to the page or download anything. Contact the service provider through a known official channel to verify it; don’t use contact details shown on the suspicious page.
• The URL looks right, but the table number doesn’t match: Check the restaurant, table number, and sign placement. Check whether it was moved during cleaning or when tables were combined. Don’t let customers continue ordering just because the menu loads.

As part of the daily routine, check signs along a consistent route before guests are seated. Use a restaurant-controlled device to preview the QR code’s destination URL first. Even for a normal entry point, verify the restaurant name, menu, and table number. Manage spare signs the same way so old ones don’t accidentally return to use after replacements are installed.

HTTPS alone doesn’t prove a page belongs to the restaurant

An encrypted connection protects data in transit, but it cannot by itself prove that a page’s identity and content are genuine. Staff should recognize the restaurant’s approved domain and look out for changes in spelling. Have a manager confirm that any short link or series of redirects follows the intended setup. Don’t end the check just because there’s a padlock icon.

If the menu entry point suddenly asks users to install an unfamiliar app, enter a verification code unrelated to viewing the menu, or provide sensitive information, stop using that entry point and verify it. Don’t ask colleagues to repeatedly enter information on their personal phones to demonstrate the risk. You can provide paper menus and in-person service in the meantime.

If a customer has already interacted with the page, handle service and investigation separately

First, ask the customer not to enter anything else or download anything, and note only the necessary details they choose to share. Staff must not take over the customer’s bank account, ask for text-message verification codes, or forward full phone-screen images to group chats. If payment information may be involved, ask the customer to contact the service provider through an official channel they find themselves and seek professional security assistance. Don’t promise that losses have been prevented.

If the menu system shows no payment, that does not prove no external transaction took place. Also confirm whether the customer intended to view the menu, place an order, or pay. Check separately whether scanning the QR code opened the page, whether an order was submitted, whether the restaurant accepted it, and whether the kitchen started preparing it, so a security concern doesn’t also result in a duplicate order.

Leave handover-ready records before restoring service

• What was found: Record the time, sign location, changes in appearance, and preview destination. Don’t retain unnecessary customer information.
• What was checked: List signs from the same batch, spare signs, and nearby areas. Distinguish overlays, signs placed at the wrong table, and configuration changes that have been verified.
• Current arrangements: Note which entry points remain suspended, who is providing menus in person, and who will continue the investigation.
• Basis for restoring service: After the manager confirms the cause and uses a sign from a controlled source, check its appearance, domain, restaurant, and table number again, then tell staff on duty which signs or areas can return to use.

Inspections cannot rule out every attack, and they do not certify that scanning a QR code is risk-free. New staff need to know where the reference copy is kept, who approves replacements, and which issues mean they must not restore affected signs or entry points to use on their own. At handover, specify exactly which signs or entry points remain suspended—not simply that the link now opens.