Toast POS QR Code Scam: Restaurant Payment Red Flags
Toast-style QR codes are common at restaurants for menus, tabs, receipts, tips, and pay-at-table flows. A real code should connect you to the restaurant's actual order or check. A fake one can collect your card details without paying the restaurant.
How fake restaurant payment QR codes work
Attackers do not need access to the restaurant's POS system. They can place a fake QR sticker over a table tent, receipt, counter sign, or tip card and send diners to a page that looks like a normal payment screen.
- Table-tent swaps: a sticker replaces the menu or pay-at-table code and opens a counterfeit checkout page.
- Counterfeit receipt codes: a fake code on a paper receipt claims to close your tab, add a tip, or view your itemized bill.
- Tip diversion: a fake QR code routes tips to a personal payment account instead of the restaurant or server.
- Phishing add-ons: the page asks you to create an account, enter a password, or save a card before showing the check.
The same physical tampering pattern appears in restaurant QR code scams, Square QR code scams, and Clover QR code scams.
What a safer pay-at-table flow should show
- The restaurant name matches the place where you are seated.
- The table, order, or check details match what you bought.
- The page does not require unrelated personal data before showing the bill.
- The tip and total are visible before you approve payment.
- The URL is not a random short link, misspelled domain, or unrelated payment page.
If any of those details are missing, ask the server or cashier to verify the code. Paying at the register is better than guessing on a payment page that does not clearly match your check.
If you entered card details
- Ask the restaurant if your bill was actually paid. If they did not receive payment, the QR page may have been fake.
- Save evidence. Keep the QR sign photo, receipt, confirmation page, URL, and card transaction.
- Call your card issuer. Explain that you entered card details on a suspected fake restaurant payment page.
- Watch for duplicate charges. A common outcome is one fake charge plus a real charge when the restaurant asks you to pay again.
For receipt-specific checks, see are QR codes on receipts safe to scan?
Frequently asked questions
Are Toast QR codes at restaurants safe?
They can be safe when the code belongs to the restaurant and the destination matches the restaurant or its expected payment provider. The risk is a fake sticker or receipt code that imitates a Toast payment flow.
What is the biggest red flag on a Toast-looking QR page?
Stop if the page asks for payment before showing your actual check, table, merchant name, or order details. Also stop if the domain is unfamiliar, shortened, misspelled, or unrelated to the restaurant.
What should I do if I paid through a fake restaurant QR code?
Save the receipt, QR sign photo, payment page, and card transaction. Tell the restaurant manager, contact your card issuer, and watch for duplicate or unfamiliar charges.
Can a fake Toast QR code steal my card?
A QR code itself cannot steal your card. The danger is a fake payment page that collects your card number, billing details, or tip payment while pretending to close a real restaurant tab.
Check table and receipt QR codes first
QRsafer previews restaurant QR destinations before menus, payment pages, and tip links open.