After scanning a QR code, read the decoded text or URL before opening it. Confirm the domain, path, and parameters against the expected destination; visually similar domains can lead elsewhere. If the code is printed or displayed publicly, test it from the actual distance and lighting users will face. A successful scan only proves the pattern can be read, not that the destination is safe or correct.