One scam app even captures your QR codes. You don’t have to look very hard for it: The developer took out an App Store ad, which means it is prominently shown when you search for authenticator apps.

A better way to manage these quick codes is to use an authenticator app, like Google Authenticator or Twilio Authy.

The growing abuse of QR codes in malware and payment scams prompts FTC warning The convenience of QR codes is a double-edged sword. Follow these tips to stay safe.