“Everything the same, looked the same,” she told Global News. “You put in your bank account and your password. ”

QR codes had nothing to do with this scam, this is functionally equivalent to clicking a sketchy link (most QR readers will even show you the domain as a preview QR codes). They were sent to a page asking for login credentials without checking the URL or site certificate. It sucks and they should get their money back but Global could have just as easily headlined this “HTTP Scam.”