Beware the square: how to spot malicious QR codes