QR codes seem magical—but bad actors can use them to collect data or money. Here’s how to stay safe.