I understand where you're coming from. I think you're implicitly assuming that once you scan a QR code, your phone automatically opens that URL. That is a faul

I understand where you're coming from. I think you're implicitly assuming that once you scan a QR code, your phone automatically opens that URL. That is a faulty assumption. There's nothing stopping someone from designing a QR code scanner app that simply displays the text (or URL) that was scanned, and gives you the option to open it in a web browser or not. A QR code is ultimately just a piece of text. It can't harm you if you don't choose to execute it. > how do I know the difference between your legitimate menu and a rogue QR code somebody slapped over top of it If someone slapped a rogue QR code on a menu, you would be able to see that it's a sticker on top of paper (or laminated paper). On the other hand, how would you tell if someone just replicated the restaurant's menu and reprinted it in whole? Anyway, if you want real trust, then the business should publish its cryptographic public key in a conspicuous place in such a way to avoid tampering (e.g. encased in glass in a wall), and then all QR codes will need to be digitally signed by that business before the customer trusts it.