The QR codes let you "check in" at venues that use Luca to make contact tracing possible.

These qr codes should only valid after you verified that you are an real person.

So the health department could call you.

This was done by SMS but the verification of an account does not check against that SMS verification but its just a simple else/if on the client.