How could phishing emails potentially use plain text characters without any formatting allowed to show a text-based QR code for the user to scan?