Read the decoded destination before following a code from an unfamiliar source.
Use the QR Code Scanner alongside this illustrative example.
A practical example
A code on a poster may decode to a URL whose brand name appears in a path rather than the domain. Compare the actual host with the organisation’s known address before opening it. If it contains plain text instead, treat that as the result rather than expecting every code to be a website.
Check the result
For a blurry image, try a better-lit photograph with the entire square and its border visible. Repeated attempts on the same cropped image will not reconstruct missing modules reliably.
Try a comparison
Compare the decoded text with a known destination obtained independently. Similar-looking letters and long subdomains can obscure the real host. For an important transaction, finding the organisation’s own page separately is a stronger check than trusting the appearance of the printed code.
What this does not establish
Decoding is not a security review. Avoid entering account or payment details solely because the scanner successfully read a code.