What QR code "on his phone" are you talking about? The OP here will have a written code, something like ED12345678 and nothing more. There's a QR code on the paper ticket: I've never gotten one on my phone.

And since this is a friend it happened to, are you clear it was both entering and exiting? As I reported here recently, I was able to exit with my passport alone recently. Admittedly I didn't try entering.