Quishing, short for QR code phishing, is climbing fast, with criminals using fake codes to prompt payments or quietly harvest customer data.