Scammers are using the codes to direct people to phishing websites, fraudulent payment portals, and malware downloads.