If you're doing that, pay attention to the codes you're getting. If you scan from an app that's already on your phone, you should be OK but if it's an individual code that doesn't require the app to be running then it's liable to all kinds of tricks.