Yeah, I think a user is several times more likely to get phished just about any other way, with the exception possibly of faux parking QR codes or similar unmanned payment requests.
Doubly so with how often 2fa or webauth is the norm on anything of note. In what situations would someone scan a random QR code and be like "yeah I should log in with my banking information here". Or, "wow this QR code asked me to install a random APK for my bank, sounds legit".
Doubly so with how often 2fa or webauth is the norm on anything of note. In what situations would someone scan a random QR code and be like "yeah I should log in with my banking information here". Or, "wow this QR code asked me to install a random APK for my bank, sounds legit".