I'd assume they want you to scan the QR code to take you to a fake payment site. Sad thing is they probably get more people than you think.