QR code phishing has emerged as a serious threat. A retrofit variation that uses cryptographic security and can even work offline might just be the solution.