The codes link to a fraudulent payment page designed to look like the website of operator PayByPhone when scanned.