How can I scan QR codes safely?

A QR code is just a web link in a pattern you cannot read by looking at it - which is exactly why scammers like them. You cannot see where one leads until you have opened it, and faking one is as easy as printing a sticker. The fix is simple: check where it goes, and never enter card or login details on a page a random code sent you.

Where the fakes turn up

Stickers placed over the real thing. On a parking meter, a restaurant table, or a poster, a scammer's QR sticker can sit right on top of the genuine one, and the machine looks completely normal.
Codes in messages, emails, and flyers claiming an unpaid fee, a held parcel, or a fine.

Safer habits

Read the link preview your phone shows before opening it. If the web address looks unfamiliar or slightly off, do not go there - and remember the word "secure" in an address means nothing.
Look for a sticker that seems stuck on over another code.
Never type card details, passwords, or personal information into a page you reached by scanning a code.
To pay, use the venue's official app or pay at the machine directly - a choice you make, not one a sticker offers you.

If you only do one thing

Treat a QR code like any link from a stranger: check the address it previews, and never enter payment or login details on the page it opens.