Another excellent layer, is to ensure that your DMARC record is published at p=reject (or at least p=quarantine) to ensure your domain is not spoofed. QR codes pretending to come from your own organization make it way too easy to trick your users that it is legitimate.