Instead of grabbing a dirty restaurant menu with our bare hands, we’ve become accustomed to the hygiene of QR codes. But they can be a lot dirtier and more dangerous than you might think.

In 2015, a German ketchup lover scanned the QR code on his bottle of Heinz and was immediately redirected to a porn site. That may be embarrassing, but there are worse consequences to blindly scanning QR codes. According to password manager 1Password, QR codes can trigger phone calls, give away your location, place a call that reveals your caller ID, and more. So what can we do about it?

“We’re all conditioned to scan a QR code to browse a menu or even pay our bills, and cybercriminals are now taking advantage of this by using malicious QR codes,” Craig Lurey, cybersecurity expert and co-founder of Keeper Security, told Lifewire via email. “So what looks like a code to pay for a parking meter, and the site will look incredibly legitimate, you’re essentially entering your credit card information directly into a thief’s database.”

A QR code is simply a shortcut to a link that can be read by your phone’s camera and then decoded. We’ve all been trained never to click on a link in an email, even if it looks legitimate. But QR code links are just as dangerous, and have the added problem that you can’t see where they lead until you scan them.