Customers urged to check when scanning a menu, as Spain ranks second globally for QR code scams

Recent reports indicate that Spain has climbed to the second position globally for QR code scams, following the United States. QR code scams, also known as "quishing," are on the rise, posing a threat to customers using menus with these codes in various establishments such as beach bars, restaurants, shops, and tourist attractions.

According to IT protection company ESET, Spain accounted for 17% of all QR code phishing detections between December 2025 and May 2026, making it the second highest percentage after the United States with 19%, and Mexico with 6%. These figures represent only ESET's own products' detections and not every attack that occurred.

Experts from Audea, the cybersecurity unit of IT firm Logicalis Spain, are urging extra caution when scanning physical QR codes. Approximately 75% of restaurants worldwide now use QR menus, providing fraudsters with ample opportunities to target unsuspecting customers. In one reported case in August, a woman unknowingly subscribed to a premium service after scanning a restaurant menu QR code, which prompted a pop-up window.

Additionally, car parks have become targets for QR code scams. In Alicante, town hall warned of fake codes that had been placed over real QR codes on pay-and-display meters for street parking. To protect oneself from QR code scams, it is recommended to read the web address that appears on your phone before opening it, ensure the code has not been tampered with, and avoid providing card details or accepting pop-ups on questionable menus.

To address such incidents, if you suspect you have been scammed, you must call your bank to block your card and report the matter to the National Police or the Civil Guard. So, consistently take an extra second to check before ordering that glass of wine or engaging in any other activity, ensuring a safer experience while enjoying Spain's vibrant establishments.