With the payment I’d be more wary.

I worry about bad actors placing their own QR codes over the official ones to redirect people to sites to steal the money, payment day, or both.