A recent New York Times article reported more than 60,000 samples of QR code attacks were discovered in Q3 this year alone. 

The most popular scams involved payroll and HR personnel impersonators and postal scams. And police in Texas even found fraudulent QR codes on parking meters, directing people to a false payment site. 

I have also heard of gas station “pay at the pump” QR codes that enable you to pay online. The irony is that the gas station codes are a result of fake hardware called “skimmers” being placed on the real credit card swiping machines. The signs with the QR codes promote keeping your card info safe and not falling prey to skimmers. And then suddenly the QR code takes you to a site asking for your credit card info.  

Stay diligent out there. If something doesn't look or feel right there's a good chance it may not be.