The easiest QR code scam to pull off is clickjacking.
Some people get paid to lure others into clicking on a certain link.
What better way than to replace QR codes on a popular monument, for example, where people expect to find background information about the landmark by following the link in the QR code.
Instead, the replaced QR code takes them to a sleazy site and the clickjacking operator gets paid his fee.