QR codes can be phishing scams in disguise, warns the FTC - The Verge

This is exactly why restaurants shouldn't use QR codes as menus, they're attack vectors - anyone can just come in and slap on their own QR sticker.