You order your coffee, find a seat, open your laptop, and reach for your phone to scan the Wi-Fi sign. It takes two seconds. You barely think about it.
That automatic, unquestioning scan is exactly what coffee shop QR code scams rely on.
Cafes — especially the kind where people settle in for hours with laptops — are among the highest-risk environments for QR fraud. Patrons are relaxed. They expect to scan menus and Wi-Fi signs multiple times a week. That habitual behavior turns off the skepticism that would otherwise catch a tampered code. Here's how each attack works and what to look for before you tap your camera.
Fake Wi-Fi QR codes
The most common attack in cafes mirrors what happens in hotels: an attacker posts a printed card or sticker — often styled to look like the coffee shop's own signage — displaying a QR code alongside text like "Free Wi-Fi — scan to connect."
Scan it and you join a network the attacker controls, not the café's actual internet. From there, any unencrypted data you transmit — login sessions, form submissions, app traffic — is visible to whoever is running that network. Attackers also commonly redirect the first page you open to a "portal" that asks for your email and password to complete the Wi-Fi login.
The real café Wi-Fi is still running normally. You just aren't on it.
What to do instead: Walk up to the counter and ask for the network name and password. Type both manually. No legitimate coffee shop Wi-Fi system requires a QR code scan to authenticate you.
Tampered table-tent menu QR codes
Post-pandemic, almost every coffee shop replaced physical menus with QR codes on table tents or counter cards. Attackers noticed.
The attack is simple: peel up the legitimate code, apply a sticker with a different QR printed on it, and wait. The replacement code routes to a fake ordering page or a phishing site dressed in the shop's branding. Victims enter their name, card details, and order — and get nothing but a fraudulent charge.
This is the same swap attack that hits restaurants, and it works just as well in cafes because the stakes feel low (it's just a coffee) and the environment is familiar.
What to look for: Check the physical code before scanning. A sticker placed over an original code often shows raised edges, a slightly different surface finish, or a misalignment with the card beneath it. If the destination URL after scanning doesn't match the café's actual domain or a recognized ordering platform, close the browser and order at the counter instead.
Fraudulent loyalty-program QR codes on receipts
A growing attack targets the moment after you pay.
Thermal-printed receipts commonly include QR codes linking to loyalty sign-up pages, review prompts, or feedback surveys. Attackers in some cases compromise point-of-sale receipt printers to substitute fraudulent QR codes — or simply slip printed cards onto tables that mimic receipt-style messaging ("Liked your visit? Scan to join our rewards club and get 10% off your next order").
The fake loyalty page collects everything: name, email, phone number, and often a credit card "to store for easy reordering." That data is sold or used directly for identity fraud.
How to verify: A legitimate loyalty program has an official app in the App Store or Google Play, or a URL that clearly matches the business. If a QR code from a receipt or a table card routes to a domain you don't recognize, don't complete the sign-up. Download the official app directly instead.
Why cafes are high-risk
Three things converge to make coffee shops unusually attractive to QR attackers:
- Habitual scanning. Regular customers scan the menu and Wi-Fi sign dozens of times without thinking.
- High foot traffic and turnover. A tampered sticker placed in the morning can capture dozens of scans before staff notice it.
- Low perceived stakes. People are more skeptical when paying for a car than when ordering an oat milk latte — so the guard is down.
How QRsafer helps
QRsafer checks the destination URL in any QR code against threat intelligence feeds before your browser ever loads the page. Scan the Wi-Fi sign, the table-tent menu, or the receipt code with QRsafer first and get a Safe, Risky, or Dangerous verdict in seconds. A newly registered phishing domain shows up in the verdict before you have a chance to enter anything.
It adds two seconds to a scan you were already going to make. That's the entire overhead.
If something already went wrong, the guide on what to do if you scanned a suspicious QR code covers every recovery step.
Quick checklist for your next coffee run
- Wi-Fi: Get the name and password from the counter — never scan a QR to connect
- Menu: Check for sticker edges before scanning any table-tent or counter code
- Loyalty programs: Use the official app or a clearly branded URL — skip unfamiliar sign-up pages
- Receipts: Verify the destination URL before entering any personal or payment info
- Any code: Scan with QRsafer first — same motion, safer result
The café feels safe because you're a regular. Attackers count on that feeling. One quick check before you scan is all it takes to stay protected.
See also
- What to Do If You Scanned a Suspicious QR Code
- Restaurant QR Code Scams
- Bar and Nightclub QR Code Scams
- Brewery and Winery QR Code Scams
- QR Code Threat Map
Download QRsafer for iOS or Android and bring the habit with you every time you sit down.