Here in France it was just a qr code in an app, you don't get a picture of the person when you scan it, so basically sharing a screenshot of the qr code would have been enough to fool most restaurants, bars and such, because nobody bothered to ask for ID.