Malicious QR code readers steal a lot of money.

Bitpay shows a different code instead of a Bitcoin address. I only use it for small amounts, but because it doesn't even show the actual address, I wouldn't know how to check if I pay the correct addy. From what I understand, this is meant to make it more secure and less prone to error for inexperienced users (but I can't check that).