A QR code is encoded data, not a tiny web browser. It can contain a URL, text, Wi-Fi credentials, contact data or other structured information. The phone decides what to do after decoding it.
Why damaged codes can still scan
Finder patterns establish orientation, while error-correction data lets a scanner recover part of a damaged or covered symbol. That is why a small logo can sometimes sit in the middle without breaking the code.
The main security problem is hidden destination data
People cannot visually read a hostname from the black-and-white blocks. A malicious sticker can therefore replace a legitimate payment or menu code with a phishing URL.
For shortened or unfamiliar destinations, inspect the redirect chain first:
To generate your own QR code and short link:
The QR image does not steal an account by itself. The risk is usually the destination and the action requested after scanning.