It's happened with Bitcoin QR codes, to redirect payment to the attacker's wallet: https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_sca...