A flyer is posted, it says, “scan this QR code, and a really great thing will happen to you!”
The code is scanned > which tells your phone to open a browser > and go to a URL, Whatever.com > where there is a virus / malware / etc > ready to be installed onto your phone.
In the settings of the scanning app, choose to allow / deny an action, before it executes.
In the above scenario, the URL might have looked off, and you decided not to click it, not to visit the webpage.
A Better Defence
Just don’t scan any, ever.
Stay sharp out there.