One word: signatures.

All QR codes or whatever the phone is displaying or transmitting should be signed by a trusted authority. The checking device can verify whether it’s been signed. You can’t generate a valid signature unless you have access to the private key that’s supposed to be signing them.

The code changes continually. Also the background moves when you tilt the phone.

In this [0] PyCon talk the app is reverse-engineered, and a version that produces a fake QR code that gets verified successfully is created.

It would seem the current approach is fundamentally broken.

[0] https://www.youtube.com/watch?v=oux3tI2V0sY

It's trivial to hack Android apps. Please see the reverse engineering talk link I posted a few comments up that demonstrates this very app being hacked.

EDIT: Probably shouldn't single out Android. iOS apps can also be modified and resigned with a developer certificate.