Customers urged to check when scanning a menu, as Spain ranks second globally for QR code scams

Most people I ask despise a QR code menu, pass me a printed one any day. Sadly for many establishments getting your phone out is the done thing. But be careful, next time you reach for your phone to check the options at a beach bar or restaurant, hold on a second, as Spain has just climbed to number 2 in the world for sneaky scams.

Spain ranks second in the world for QR code scams

IT protection company ESET reports that Spain accounted for 17% of all QR code phishing detections it recorded worldwide between December 2025 and May 2026. Only the United States, on 19%, came higher, with Mexico third on 6%. These figures reflect what ESET’s own products caught, not every attack that took place.

Phishing, for anyone new to the term, means fake websites built to trick you into handing over passwords or bank details. The QR version has been nicknamed “quishing”.

Where the fakes are hiding

Experts at Audea, the cybersecurity unit of IT firm Logicalis Spain, are urging extra care with physical codes in shops, transport, tourist attractions, car parks and restaurants. Roughly 75% of restaurants worldwide now use QR menus, which gives fraudsters plenty of tables to target.

Spain’s national cybersecurity institute, INCIBE, logged a case in August in which a woman scanned a restaurant menu code and accepted a pop-up window. She ended up subscribed to a premium service she never requested.

Car parks are also targets. Alicante’s town hall warned in 2025 that fake codes had been stuck over the real ones on its ORA machines, the pay-and-display meters for street parking.

Three quick checks before you scan

You need not give up QR codes altogether. Three habits go a long way:

– Read the web address that appears on your phone before opening it.
– Check the code has not been stuck over another one.
– Walk away if a menu asks for card details or urges you to accept a pop-up.

EWN has previously covered similar incidents at electric car charging points here, as well as scam codes tucked into unsolicited parcels found here.

If you think you have been caught out, you must call your bank at once to block your card, then report it to the National Police or the Civil Guard.

So when out and about, always take one extra second to check before you go any further with ordering that crisp glass of wine.