>whats stopping someone from sticking up a couple of QR codes that link to a fraudulent payment page or some other malware?
This will become a huge problem / is already a problem. Whats the right way to solve this? some sort of https like trust relationship for the whole QR code interation?