This is definitely already a thing. There were reports of that happening here in Japan when the QR code payment system PayPay took off a few years ago. People would paste their own QR code ontop of the store one

Seems like an opportunistic scam, and a great way to get caught if the would-be scammers do not previously put in place a serious money trail obfuscation system. The investigator has, as the first piece of evidence, basically a direct link to the criminals' bank/ccard acct, for which the bank is legally required to have owners' ID. The casual scammers get caught, the professionals/serious gangs easily obfuscate the trail, and trust in the systems declines further.

In the current state of play you might be right.

I think many of the same rules apply to anti-phishing. A lot of it is about education: making sure that patrons know what a legitimate QR code domain is going to be in advance so they can check it, providing some reporting system for suspect ones (this probably just means telling a member of staff so they can scrape it off and tell the police).

There are some additional advantages afforded to us in the real world like, if the need arise, they could be made hard to forge by including custom holograms, embossed patterns and the like.

Although at the moment it seems not many places are taking advantage of these kinds of practices yet, probably because a high profile breach has yet to happen around it.

In 2011 I remember reading about “QR phishing”, where a transparency is overlaid on a QR code to completely change the data while barely modifying the representation.

http://wordpress.mrreid.org/2011/08/06/hacking-qr-codes/