Information current as of 09/10/2026.
Do not scan the QR code, open related links, provide information, download an app, or make a payment. Verify any possible order independently through a retailer or delivery service website or app you already know, and report the package through appropriate official channels. Receiving the package alone does not confirm that your account or device was compromised, but take additional security steps if you scanned the code, entered information, downloaded anything, granted permissions, or notice unauthorized activity.
Immediate action: do not scan the QR code
Treat an unexpected package with a QR code cautiously. Do not scan the code, use contact details supplied inside the package, click related links, enter passwords or payment details, download an app, grant device permissions, or pay a fee. A QR code from an unknown source may lead to phishing or a malware download.
What the package may mean
The package may be part of a brushing scam, in which merchandise is sent without your request, combined with quishing, the QR-code form of phishing. It may indicate that personal information was obtained or used, but receiving the package by itself does not establish account takeover or device compromise.
Choose the right response
If you did not scan the code or interact with the linked request, leave it unused and verify any suspected order independently through a retailer or delivery service website or app that you already know is official. Do not contact the sender through the QR-linked site or use phone numbers, web addresses, or other contact details supplied with the package. If you scanned the code or submitted information, change exposed credentials—especially reused passwords—enable multifactor authentication, review financial activity, and remove or assess any app or permission granted. Monitor shopping accounts and credit information for misuse.
Verify and report through independent channels
Use a known official website, app, or phone number to check whether the package corresponds to an order. Report the incident to the relevant retailer or platform, postal or delivery service, and appropriate fraud-reporting authority in the United States. Do not rely on unverified sender information supplied in the package.
Hazardous-content exception
If the package contains an unknown liquid, substance, food, seeds, or another potentially hazardous material, avoid handling it further and follow instructions from appropriate local authorities.
Sources
- Scam alert: QR code on an unexpected package
- Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes
- Brushing Scam
- That unexpected package you got could be a brushing scam
- Scammers hide harmful links in QR codes to steal your information
- Cybercriminals Tampering with QR Codes to Steal Victim Funds
Frequently asked questions
Should I scan the QR code on an unexpected package?
No. Do not scan a QR code from an unknown source. If you need to check whether the package is legitimate, use a retailer or delivery service website, app, or phone number that you know is official instead of information supplied with the package.
What should I do if I get an unexpected package with a QR code?
Do not scan the code, click its links, provide information, download an app, or make a payment. Verify possible orders independently, monitor shopping accounts and credit information, and take account-security steps if you scanned the code or entered information.
Is an unexpected package with a QR code a scam?
It can be a brushing scam combined with quishing, or QR-code phishing. The package alone does not prove that an account or device was compromised; stronger warning signs include entering credentials, providing payment information, downloading malware, granting permissions, or seeing unauthorized activity.