A QR code can point anywhere, and you can't tell where just by looking at it. Here's how to check before you tap.