Yes, even QR codes sent in an email could take you to a malicious website, which could install a virus or steal your data. As with phishing emails and texts, check the language, the sender and whether it's something you were expecting.
