A QR code on a poster or in an email can hide a malicious website just as a link can. Confirm the destination and use a known university page for logins, payments, and shared files.