Package You Didn't Order? Don't Scan the QR Code Inside

A package arrives with your name on it. You did not order it. Inside is something random, and often a small card: scan this code to see who sent your gift.

Do not scan it. That card is the whole point of the delivery.

The FTC issued an alert in August 2026 warning that scanning can take you to a phishing site built to capture card numbers, usernames and passwords. The FBI issued its own public service announcement about the same thing, noting the code can also install software that steals data from your phone.

The package itself is nearly harmless. The card is not.

Read next: Who calls from (270) 795-3919? Reported 10 times from Kentucky

What a brushing scam is

A seller, usually overseas, ships a cheap item to a real name and address they obtained somewhere. They then use that delivery to post a verified purchase review of their own product.

A verified review carries more weight than an ordinary one, so it lifts the product in search results. The item you received cost them a few dollars and bought them a review worth far more.

For years that was the whole scheme. Annoying, slightly unsettling, but not directly dangerous to you.

What changed

The QR code turned it into something else.

Read next: Rental Scams in 2026: $275 Million Lost and How to Spot One

The Postal Inspection Service calls this variation quishing, short for QR code phishing. The card promises to reveal the sender, or to process a return. Scanning opens a site that looks official, sometimes copying a bank or a delivery company, and asks you to enter details.

The FBI's advisory adds a second risk. In some cases the code prompts a download, or asks for permissions, which is how data gets taken from the phone rather than typed in.

There is also a version with no product at all. Just an envelope with a printed code.

Why the code is worse than it looks

You cannot read a QR code. That is the point of one.

Read next: Is ShopVSB.com Legit? Vitamin Sea Boutique Review 2026

A suspicious link in an email can be examined before you tap it. A QR code is a black and white square that gives you nothing until you have already arrived at the destination. Whatever caution you would normally apply to a link cannot be applied here.

Add the setting. The code arrived inside a physical package, with your correct name on it, which does not feel like the internet at all.

The part that actually matters

Even if you never scan anything, the delivery tells you something.

Somebody has your full name and your address, together, and used them. That combination came from a data breach, a marketing list, or a purchase you made somewhere.

The FTC's guidance is not to panic but to check, because an unexpected package can be a sign that your information is circulating.

It is worth saying plainly: a package on its own is not evidence that your bank account has been reached. It is a prompt to look, not a reason to assume the worst.

What to do with the package

The Postal Inspection Service sets this out clearly.

• You can keep it. Federal law says you are under no obligation to pay for unsolicited merchandise, and you do not have to return it.
• If it is unopened and has a return address, you may mark it "RETURN TO SENDER" and USPS will return it free of charge.
• Do not post it back to the address on the label yourself. That confirms the address is live and in use.
• If you opened it and do not want it, throw it away, as long as it is safe to do so.
• If it contains seeds, plants, food, or an unknown substance, do not handle it. Report it to the authorities and follow their instructions. Unsolicited seeds in particular have been treated as an agricultural risk.

The four checks to run today

None of these takes long, and together they close the gap the package pointed at.

1. Change your shopping account passwords. Amazon first, then any marketplace you use. The FTC recommends this specifically, because a compromised account is one way these deliveries get arranged.
2. Review your card statements for anything small and unfamiliar. Testing charges are deliberately tiny.
3. Check your credit report. It is free weekly at AnnualCreditReport.com, covering Equifax, Experian and TransUnion. Look for accounts you did not open.
4. Tell the marketplace. If the package came from Amazon or a similar platform, message them. They investigate and remove sellers running these schemes, and your report is how they find them.

If you want a stronger step, a credit freeze is free, does not affect your score, and can be lifted whenever you need it.

If you already scanned the code

Act in this order.

1. If you entered card details, call your card issuer now and ask them to freeze the card. Do not wait to see whether a charge appears.
2. If you entered a password, change it immediately, and change it anywhere else you used the same one. Start with your email, because it is the reset route for everything else.
3. If you approved a download or a permission request, remove the app, then check your phone's app list for anything you do not recognise. Restart the device.
4. Turn on two step login for your email and your shopping accounts. Our device settings guide covers how.
5. Report it to the FBI at ic3.gov, and to the FTC at reportfraud.ftc.gov. The FBI asks for the sender details, the websites involved, and any app you granted permissions to.
6. If personal data was taken, start a recovery plan at IdentityTheft.gov.

The rule that covers every QR code

Never scan a QR code that arrived unrequested.

Not in a package, not in a letter, not in a text about a delivery or a toll, not on a sticker placed over a parking meter. The FTC has warned about all of these, and the sticker version is a real technique, since criminals cover a legitimate code with their own.

A code you sought out is different. A restaurant menu you asked for, a ticket you opened yourself. The danger sits entirely in codes that come to you.

When a message says a package could not be delivered, go to the courier's own app or type their address yourself. Our guide to the five scam texts to know covers the delivery version, which is the most reported text scam in the country.

What to tell an older relative

Keep it to one sentence, because that is what survives the moment.

If a package you did not order has a code to scan, throw the card away and keep the gift.

Then add the reassurance, because it is what makes people speak up: getting a strange package is not their fault and does not mean they did anything wrong. It means a company somewhere lost their details.

Check before you scan or call

If the package included a phone number or a website, look it up first.

Check a phone number or website here, free and in about ten seconds.

Sources

• FTC Consumer Advice, That unexpected package you got could be a brushing scam, August 2026
• FBI Internet Crime Complaint Center, Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes
• United States Postal Inspection Service, Brushing Scam
• FTC Consumer Advice, What to do if you were scammed