That QR code on your counter might not be yours anymore

The short version

QR code phishing, “quishing,” is up significantly in 2026, and the Better Business Bureau has specifically flagged a low-tech version of it that hits businesses directly: someone walks up to your counter, your table tents, or your storefront window and sticks a counterfeit QR code sticker directly over your real one. It takes about five seconds. If you use QR codes for menus, ordering, tipping, or payment links, it’s worth a two-minute check this week.

How the scam actually works

The attacker prints a QR code that looks identical to a generic black-and-white square and pastes it over your legitimate one, on a table tent, a window decal, a tip jar, a parking sign, anything with a scannable code a customer trusts. A customer scans it expecting your menu or your payment page and instead lands on a lookalike site built to steal a card number, or in some cases a login. The BBB and local outlets have reported this specifically happening in hotel lobbies, airport terminals, parking areas, and restaurants, and industry trackers have cited QR phishing volume surging well over 100% in the first half of 2026 compared with the prior year.

What makes this version of the scam effective is that it doesn’t require hacking anything. Your actual ordering or payment system is never touched. The only thing that changed is a physical sticker, which is exactly why it’s easy to miss. Nobody thinks to inspect a QR code they walk past every day.

A two-minute counter check

Run this weekly, or daily if you’re in a high-traffic spot:

1. Physically look at every QR code a customer can scan: table tents, window clings, counter signage, tip jars. Check for a sticker edge, a slightly different paper texture, or a code that looks “pasted on” rather than printed into the material.
2. Scan one yourself and confirm the URL that comes up matches your actual domain before it loads anything else. If it redirects somewhere unfamiliar, pull it immediately.
3. Compare the code against a reference photo. Take one photo of each legitimate code when you first put it out, and glance back at it during your check. A swapped sticker is obvious side by side and easy to miss from memory alone.
4. Ask staff to flag anything that looks off: a code in a new spot, a sign that looks different than yesterday, a customer saying a link looked strange.

Lower the odds it happens at all

• Use dynamic QR codes where your payment or ordering provider supports them, codes tied to a platform account rather than a static printed image, since a fake overlay is more obviously a different domain when a customer looks closely.
• Laminate or mount codes in a way that makes a sticker overlay visible, a recessed sign holder instead of a flat surface, for instance.
• Put your domain name in plain text next to the code, so a customer has something to double-check against even without scanning carefully.
• Brief staff once. A thirty-second explanation of what to look for is the whole training requirement here.

If you find a fake one

Remove it immediately, photograph it, and keep the photo in case a customer reports a problem tied to that time period. If a customer tells you they entered card information on a page that didn’t look like your usual checkout, take it seriously, loop in your payment provider, and consider a short note to recent customers if there’s reason to think more than one person was affected.

If you’re setting up QR ordering or payment links for the first time, our hardware page covers Clover’s built-in QR options, which tie codes to your account rather than a static image, making this specific swap attack harder to pull off.

This is general safety guidance, not legal advice. If you believe customer payment data was compromised, consult your payment processor’s fraud team and, depending on your state and the scope, legal counsel about notification obligations.

The bigger point

This isn’t a sophisticated attack. It’s a sticker. That’s exactly why it works, and why the fix is just as unglamorous: look at your own signage the way a stranger would, regularly, and keep a reference photo on hand. It costs nothing and takes less time than making a pot of coffee.

Sources: Better Business Bureau QR code scam alerts (2026); Times Free Press, “BBB warns: Think before you scan — that QR code could be a scam” (August 2026); industry reporting on first-half 2026 quishing volume trends.