The fraudulent QR codes directed users to a fake website that collected payment, rather than to the real PayByPhone module.