Victims are tricked into scanning QR codes or approving collect requests that send money instead of receiving it.