Physical letter scam targets Ledger and Trezor customers with fraudulent letters containing QR codes linked to credential-stealing sites.