NBC: 'Quishing' scams dupe millions of Americans as cybercriminals exploit QR codes