Scams going around · Letters and packages

Unexpected package QR code scam

Pretends to be a mystery gift-giver, or an online store such as Amazon. A package you didn't order arrives in your name. A note inside says it's a gift, but not who sent it. It tells you to scan a QR code (a square barcode your phone camera can read) to find out. But the code can open a fake website that steals your card numbers and passwords. It can also put harmful software on your phone. It's a twist on a brushing scam. That's when a seller sends you something you didn't order, then uses your name to post a fake review.

An example of what it can look like

Not a real message: the details are made up.

No sender name or return address (a note inside the box)

Surprise! Someone special sent you this gift. Want to know who? Scan the QR code below to see the sender's name and message. Need to send it back? Scan the same code for return instructions. [QR code]

How to tell

• A package arrives in your name, but you didn't order it and you don't know who sent it.
• There's often no sender name or return address on the box. Or it may look like it came from a store like Amazon, or from a person or business you've never heard of.
• Inside is usually something cheap and random, like baby wipes, toothpaste or seeds.
• A note says it's a gift but doesn't say who sent it. It tells you to scan a QR code (a square barcode) to see who sent it or how to return it.
• If you already scanned the code, it may have opened a website that asks for your card number, username or password.

What to do

• Don't scan the QR code (the square barcode on the note), and don't type in any web address on the note.
• Ask family and friends if one of them sent it. Either way, the law says you don't have to return or pay for things you didn't order. You can keep it as a gift.
• Be careful about using what's inside, since you don't know who sent it.
• Change the passwords on your online shopping accounts, in case someone got into them.
• If the package came from Amazon or another online store, tell that store. Use its own website or app, so it can look into the seller.

If you already tapped, paid, called or replied

1. If you typed a username and password on the website, change that password right away on the real account. Go to the website or app yourself, not through the QR code (the square barcode). If you use the same password anywhere else, change it there too. Then turn on two-step sign-in (a second check, such as a code sent to your phone).
2. If you gave a card number, check your credit card and bank statements for charges you didn't make.
3. Get your free credit report at AnnualCreditReport.com. You can get one every week. Look for accounts in your name you don't recognize. If you think someone stole your identity, report it and get a recovery plan at IdentityTheft.gov.
4. Think about a credit freeze. It's free. You place it with each of the three credit bureaus (the companies that keep credit reports): Equifax, Experian and TransUnion. Until you lift it, no one can open a new credit account in your name, including you.
5. Did the code put an app on your phone, or ask you to allow access to something? Get help from someone you trust who knows phones. Write down the app's name for your report.

How to check for real

If you think a friend or relative sent it, ask them, using a phone number you already have. If the package looks like it came from Amazon or another online store, go to that store's website or app yourself. Don't use the QR code (the square barcode on the note). Send the store a message so it can look into the seller.

Where to report it

• ReportFraud.ftc.gov, the Federal Trade Commission's reporting site
• The FBI's Internet Crime Complaint Center at ic3.gov. If you're 60 or older and want help filing, call the Department of Justice's Elder Justice Hotline at 1-833-FRAUD-11 (833-372-8311).
• The online store the package came from, such as Amazon, through its own website or app
• IdentityTheft.gov, if you think someone is using your personal information

Free guides that go with this

• Read the free guide
• Read the free guide
• Read the free guide
• Read the free guide

Check a message you got, free · Check a link

Where this comes from

Written from these official warnings, checked 2026-09-25. Lantern is not part of any organization named on this page.

• FBI IC3: Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes
• FTC: Scam alert: QR code on an unexpected package
• FTC: That unexpected package you got could be a brushing scam
• FTC: Credit freezes and fraud alerts