One QR: The One-Code Standard for Secure Table Ordering and Contactless Payments

A table covered in three or four different QR codes — one for the menu, one for ordering, one for payment — makes it easy for a fake sticker to blend in. One QR consolidates every guest action — menu, ordering, an open tab, and payment — behind a single verified code per table, removing that clutter and making a scam sticker instantly obvious.

In this article:

• Why multiple codes create risk
• What is quishing
• What One QR replaces
• How it works for a guest
• How it protects both sides
• Why no app is needed
• A new revenue channel
• How it connects to your data
• How it connects to promotions
• See OneQR on your own tables
• Frequently Asked Questions

Why do multiple QR codes on one table create a security risk?

Every additional QR code on a table is one more thing a guest has to trust, and one more surface a scammer can imitate. When a table has separate codes for the menu, for ordering, and for paying the bill, a guest has no simple way to tell which one is genuine. A single printed sticker, placed over a real code by someone who was never at the table to begin with, looks exactly like the rest.

This isn’t a hypothetical. Fraudsters paste fake QR stickers over genuine codes on tables, doors, and meters, and the fake code opens a phishing page built to look like a real menu, a bank page, or a payment screen. A “scan to pay” code can quietly redirect money and harvest card details, and the more codes a table has, the less a guest questions any one of them. The real problem was never QR codes themselves — it’s that a table with several of them gives a rogue one somewhere to hide.

What is quishing, and why are restaurant tables a target?

Quishing — QR code phishing — is a phishing attack that uses a fraudulent QR code, often a sticker placed over a legitimate one, to redirect a scan to a fake payment or data-collection page. It’s a genuinely fast-growing threat: Microsoft’s own Q1 2026 Email Threat Landscape report recorded QR-based phishing attacks climbing from 7.6 million in January to 18.7 million in March — a 146% increase in a single quarter, making it the fastest-growing phishing technique Microsoft tracked.

That data is about email-delivered quishing, but the same sticker-swap mechanic works physically, in person. Reporting on the physical variant has specifically flagged restaurant tables, parking meters, and public kiosks — in tourist-heavy cities including Miami, Dallas, Seattle, and Philadelphia — as common targets, precisely because a QR code sitting on a dining table feels routine enough that guests rarely think to question it. A restaurant table is, in other words, an unusually convenient place to hide a scam — which is exactly why the number of legitimate-looking codes on it matters.

What is One QR, and how does it replace every code at the table?

One QR is Sapaad’s answer to that clutter: one trusted code per table that replaces every other QR a guest would otherwise encounter during a visit. It bundles four things guests would normally need separate codes (or a separate app) for:

• QR Menu — a live digital menu, always current, photos included
• QR Ordering — browsing, customizing, and sending orders straight to the kitchen from a guest’s own phone
• Open Tab QR — the tab stays open for the whole visit, so guests can keep ordering rounds without flagging down staff
• Scan & Pay — viewing the bill, splitting it, tipping, and paying securely the moment guests are ready to leave

One sticker, printed once and mapped to that specific table, replaces what would otherwise be several separate codes — which means there’s only one thing on the table for a guest to verify is genuine, and only one thing for restaurant staff to check for tampering.

How does One QR actually work for a guest?

The experience is designed to be a single, uninterrupted flow from being seated to walking out:

1. Scan once — the table’s One QR opens directly in the guest’s phone browser.
2. Browse — the full live menu appears, right on their phone.
3. Order — items are sent straight to the kitchen.
4. Keep the tab — guests can order more rounds any time; the tab stays open for the whole visit.
5. Pay & go — split the bill, add a tip, and settle up, all from the same screen.

Nothing else to scan, nothing to download, and nothing for a guest to second-guess partway through the visit. In practice, that might look like four friends at a table — say, Aisha, Omar, Sara, and Zane — all scanning the same code, each adding their own order to one shared list they can all see updating in real time, then splitting the bill four ways at the end: evenly, by item, or by exactly what each person ordered. Anyone who needs to leave early can settle just their own share and go, while the table’s tab stays open for whoever’s still eating. For a closer look at how this plays out with a full table splitting a bill, see our companion piece on how Gen Z actually wants to order and pay.

How does One QR protect both guests and the restaurant?

A single verified code protects both sides of the table, in different ways:

For guests: one verified code means a fake sticker stands out instantly instead of blending in. There are no app downloads, no rogue links, and no unnecessary data collected along the way — guests order at their own pace and pay through their own preferred method (Visa, Mastercard, Amex, Apple Pay, Google Pay, or a digital wallet), with payment staying on Sapaad’s own secure channel rather than being routed through a third party.

For the restaurant: there’s only one sticker per table to print, place, and check — which means staff can spot a rogue code immediately, since anything extra simply shouldn’t be there. Payments settle through the restaurant’s own system rather than a patchwork of channels the business doesn’t fully control.

Why doesn’t One QR require an app?

One QR opens as a full web app directly in the guest’s browser the moment they scan — there’s no app store, no download, and no sign-up wall standing between a guest and their order. That matters for security as much as convenience: every app a restaurant asks a guest to install is another login, another set of permissions, and another piece of software a scammer could try to impersonate. A browser-based experience removes that entire category of risk, while still supporting the features guests actually want — live menus and prices that update in real time, group ordering where everyone scans the same table code and adds to one shared order, and flexible splitting by item, by person, or evenly across the table.

Does One QR create a new revenue channel, not just a safer one?

Security is the starting point, but consolidating every guest action onto one code also turns the table itself into a channel a restaurant fully controls. Because payment stays on Sapaad’s own channel rather than being routed through a third-party ordering app, a restaurant isn’t paying marketplace commissions on orders that started at its own tables — the channel sells from day one, with no separate app to launch and no third party taking a cut.

That control also opens up revenue that a cluttered, multi-code table setup tends to leave on the table, literally: smart tipping prompts at the moment of payment, with every tip tracked and reported for fair staff payouts, and an optional, configurable convenience fee on digital orders that can offset processing costs. Self-serve ordering also tends to mean more rounds and bigger baskets over the course of a visit, since guests can order again without waiting to flag down a server — table turns move faster without adding staff.

How does One QR connect to the rest of a restaurant’s data?

Every scan, order, and payment through One QR feeds directly into the same systems covered in our Ask Vantage and Sapaad Signals coverage — which means a restaurant isn’t just accepting orders more securely, it’s also generating data it can act on. In practice, that looks like being able to ask Ask Vantage plain-language questions such as “how much did Scan & Pay add this month?” or “which branches have the lowest scan-to-order rate?” — and having Sapaad Signals flag events like a table sitting idle with an open tab, or a walkout risk, the moment they happen rather than after the guest has already left.

How does One QR connect to the Unified Promotion Engine?

One QR is built to work with Sapaad’s Unified Promotion Engine, which matters most for restaurant groups running more than one location. A promotion built centrally at head office can go live on every table’s One QR instantly, with no reprinting and no per-branch setup — and it can be targeted precisely, by branch, daypart, menu, or guest behavior, so a happy-hour offer can run at one location while a different combo deal runs at another, all from the same engine.

Because the offer appears inside the ordering flow itself — not as a separate coupon or a code a guest has to remember — it shows up at exactly the moment a guest is deciding what to order, which is when an upsell or bundle is most likely to actually change what ends up in the basket. For a multi-unit group, that combination of centralized control and table-level precision is difficult to replicate with a table setup built from several disconnected codes and apps.

See One QR on your own tables

The fastest way to judge whether a single verified code actually feels different from a cluttered table is to see it scanned, live, on a real table setup. In a walkthrough, the Sapaad team can show exactly how a guest experience looks from the first scan through to splitting and paying a bill — and how a rogue sticker would visibly stand out against your own printed code.

Book a demo of One QR and see the full guest flow on your own table setup.