Drivers in New York City who scan a QR code on a parking meter to pay may instead hand their payment details to a scammer.