Isn't this easily solvable by the URL based codes have to have a signature and other verification that the browser can enforce? So instead of a link to paypal to pay me, it is a link to the bar's website and that site has a paypal popup originated from the bar's website.