Can't the attacker just man-in-the-middle to the real bank, and show the QR code to the phone? Does the entire transaction take place on the phone? I don't thi

Can't the attacker just man-in-the-middle to the real bank, and show the QR code to the phone? Does the entire transaction take place on the phone? I don't think that's a good option.