It is allowed to hide any information in the qr-code, including phishing information. The hacker is able to add a link to the QR code, by clicking on which you can subscribe to a paid newsletter or catch a virus on your mobile device. There is a risk that the embedded URL has been hacked.