Scammers are hijacking tap-to-pay donations to turn a $20 gift into a $2,000 charge—here’s how to protect your money