QR codes hide one scam that's getting harder to spot.