Fraudsters swap QR codes outside shops to get payments diverted to their accounts