Imagine sitting down for a simple meal, only for the waiter to hand you a bill for nearly ₹10 lakh for dozens of dishes you never ordered. That bizarre nightmare recently became reality for popular American Twitch streamer Lacy, whose real name is Nicholas Fosco.
While dining at a restaurant in Japan, Lacy was broadcasting live to his audience. During the stream, the ordering QR code on his table accidentally flashed on screen. Within minutes, thousands of mischievous viewers scanned the code remotely, accessed the restaurant’s digital ordering portal, and sent order after order straight to the kitchen.
By the time the staff noticed the endless stream of food and approached him, receipts totaling around 1.6 million yen (roughly $12,000 USD) had piled up. Lacy reported that he decided to clear the bill himself so the business would not suffer, asking the restaurant to distribute the mountains of food to local families. But the chaotic prank raises a serious question: if something like this happens to you, are you legally forced to pay?
The Digital Ordering Trap: Convenience vs Security
Since the pandemic, QR code menus and automated table-ordering platforms have popped up across restaurants worldwide, including India. In most cases, you sit down, point your camera at a printed black-and-white square, select your food on a webpage, and hit order.
The issue is that many of these digital systems contain zero security layers. They do not verify GPS location, they do not check device IDs, and they do not require immediate digital payment or an OTP before sending the order to the kitchen. Anyone with an image or URL of that specific table’s QR code can order as if they were sitting in that booth.
What The Law Says: Are You Liable for the Bill?
Under Indian law, placing an order at an eatery forms a basic commercial contract. However, for a valid contract to exist under the Indian Contract Act, 1872, there must be free consent between the parties.
- Lack of Consent: Under Section 10 and Section 14 of the Indian Contract Act, an agreement requires mutual consent. If strangers on the internet trigger orders without your knowledge or authorization, no valid agreement exists between you and the restaurant for those extra items.
- No Agency Relationship: A patron is not liable for the actions of unknown third parties unless those parties are proven legal agents authorized to act on their behalf. Random livestream viewers are not your agents.
- Vendor Due Diligence: Under consumer jurisprudence, businesses operating digital interfaces bear the duty of ensuring their systems are reasonably secure. If a restaurant chooses an insecure ordering system that accepts orders without verifying who is placing them, the commercial risk generally sits with the establishment, not the unsuspecting customer.
Is Trolling via QR Code a Cybercrime?
Many internet users treat these incidents as harmless online pranks. In the eyes of Indian cyber law, however, placing unauthorized orders on someone else’s system can amount to a punishable offence.
1. The Information Technology Act, 2000
Under Section 66 of the Information Technology Act, any person who dishonestly or fraudulently causes damage, alteration, or disruption to a computer resource without authorization commits a computer-related offence. By deliberately sending fake orders to overwhelm a business or financially harm a customer, the perpetrators intentionally manipulate a digital system without permission.
2. Cheating and Mischief under the BNS
Under the Bharatiya Nyaya Sanhita, 2023 (BNS), which replaced the Indian Penal Code, such acts fall under specific criminal provisions:
- Section 318 of the BNS (Cheating, formerly Section 420 IPC): Deceiving an eatery into preparing food under the false pretense that a patron at the table requested it meets the threshold of cheating and inducing delivery of property.
- Section 324 of the BNS (Mischief, formerly Section 425 and 426 IPC): Mischief involves doing an act with the intent to cause wrongful loss or damage to the public or to any person. Spoiling food or causing direct financial injury to a venue through automated spam constitutes digital mischief.
What Happens Next If This Happens to You?
If you ever find yourself facing an inflated bill due to an exposed QR code or unauthorized digital access, consider these steps:
- Refuse Unauthorized Line Items Immediately: Politely but firmly notify the manager as soon as unrequested food arrives. Make it clear on record that you never authorized those entries.
- Request Digital Audit Logs: Digital menus maintain timestamps and IP addresses. The restaurant’s system administrator can easily see that the orders originated outside the restaurant premises.
- Do Not Sign or Pay Under Coercion: While streamer Lacy chose to absorb the cost voluntarily out of goodwill toward the kitchen staff, consumers under Indian law are not legally required to pay for goods delivered due to third-party fraud.
Why This Matters For Everyday Citizens
This incident is a reminder that everyday conveniences carry digital vulnerabilities. QR codes are not just menus; they are direct links that trigger financial and contractual actions. Streamers, vloggers, and ordinary diners uploading photos to Instagram must treat table codes, payment barcodes, and booking numbers as private data. Once posted online, you lose control of who clicks the button.
Story reported by Top Trending News, Viral Videos, Latest Viral News, Odd News, Memes and Puzzles, Social Media Viral News | Hindustan Times. This article is BareLaw’s independent explanation and analysis.
📲 Get every BareLaw story on Telegram — simple legal news, 5 times a day, free: t.me/barelaw
