Yes, it is easy for a cyber criminal to place a QR code that sends users to malicious websites that steal user data or payment information.