In recent weeks, we have been getting more and more reports of suspicious messages that do not contain a visible link or button but do contain a QR code. This QR code leads to a suspicious website. This is how scammers try to prevent our systems from blocking their URLs, but that is beyond our technology. We can also scan QR codes and have suspicious links behind them blocked.
So it definitely pays to also forward suspicious messages with a QR code to email@example.com.
Example of phishing with QR code: