> Before scanning a QR code in a public place, check who put it there — stickers get swapped over the real thing.
> Your phone previews the URL before opening it. Read it. A lookalike domain is the whole trick.
> Never enter a work login or personal data on a page you reached from an unexpected QR code.
> Not sure? Ask IT before you tap through. That question is never a bother.