Good spot CP... I had read that but didn't put two and two together.
Does likely mean that the PCN is valid and that there was a charge which wasn't paid.
I'm not so sure. Yes it's not the council's fault, but if the QR code was over the top of the actual payment instructions, and it appeared legit, it seems to me that there wasn't adequate guidance to motorists as to the effect of the traffic order.
After all, if the signs and payment instructions had simply been vandalized / spray painted over such that payment could not be made, the motorist would normally not be deemed to be in contravention, as it is for the council to provide adequate guidance. I don't see why the fact that the vandals in this instance are scammers would make any difference. This is rather different from people paying the CC or ULEZ charges on a scam website, because the authority is not responsible for providing web search results on a motorist's web browser, but it is responsible for providing signage telling motorists how to pay.
If a motorist sees an apparently legitimate sign saying scan this QR code, that is very different to going online and paying the congestion charge charge to
http://pay-this-scammy-website-for-cheap-congestion-charge-scam.com@mothepro did you find any unauthorised activity on your card? Have you contacted the bank to cancel your card and order a new one?