Unsolicited packages with QR codes pose serious fraud risk, FBI warns

QR codes that were once seen as a convenient shortcut for checking menus or paying bills have increasingly been turned into weapons. Fake delivery texts, counterfeit payment links and malicious codes pasted over legitimate ones have all become part of the modern fraud playbook.

The latest warning from federal authorities shows just how far these tactics have gone. Criminals are now mailing out packages that people never ordered. Inside these boxes is a QR code that, when scanned, can lead to stolen personal details, drained bank accounts or malware running silently in the background of a phone.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

QR CODE SCAMS RISE AS 73% OF AMERICANS SCAN WITHOUT CHECKING

What you need to know about the QR code scam

The scheme is a twist on what is known as a brushing scam. Traditionally, brushing scams involved online sellers sending products to strangers and then using the recipient’s details to post fake reviews. It was more of a nuisance than a serious crime.

Now the practice has shifted from harmless free items to deliberate fraud. Instead of receiving a product, many victims find only a printed QR code. Once scanned, the code redirects them to fraudulent websites that ask for sensitive personal information, such as banking information, credit card numbers or login credentials. Some codes go a step further and install malicious software designed to track activity and steal data directly from the device.

“The FBI warns the public about a scam variation in which criminals send unsolicited packages containing a QR code that prompts the recipient to provide personal and financial information or unwittingly download malicious software that steals data from their phone,” the agency said in a public notice. “To encourage the victim to scan the QR code, the criminals often ship the packages without sender information to entice the victim to scan the QR code.”

WHATSAPP BANS 6.8M SCAM ACCOUNTS, LAUNCHES SAFETY TOOL

Why QR codes appeal to scammers

QR codes have become common in everyday life. They are used in restaurants, stores, airports, on polls and payment systems and most people scan them without a second thought. Unlike suspicious links that can be spotted, a QR code reveals nothing until it is scanned.

That makes it a perfect disguise for a scam. The setup is simple: a package arrives with no sender information and no explanation. The mystery sparks curiosity, and many people scan the code to figure out who sent it. That moment of curiosity is what the scammers rely on.

The consequences can be serious. Fake websites may harvest names, addresses and financial details. Malware may silently monitor accounts, log keystrokes or even target cryptocurrency wallets. Victims often do not notice until they see unauthorized charges or suspicious withdrawals. By then, their information may already be in the hands of criminals.

DON’T FALL FOR THIS BANK PHISHING SCAM TRICK

7 ways to stay safe from QR code scams

Scammers rely on curiosity and convenience to trick people into scanning malicious QR codes. A few simple habits can help you avoid becoming a target. Here are seven ways to stay safe from QR code scams.

1) Be cautious with unsolicited QR codes and use strong antivirus software

Avoid scanning QR codes from mystery deliveries, random flyers or stickers on public signs. A QR code is just a disguised link, and until you know where it leads, it shouldn’t be trusted. To stay safe even if you accidentally scan a risky code, keep strong antivirus software on your phone. Mobile security apps can block fraudulent sites, warn you before downloads and protect against malicious QR code attacks.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

2) Stick to trusted sources

Only scan QR codes from businesses and organizations you already trust. Examples include your bank’s mobile app, an airline boarding pass or a known retailer’s checkout page. If you wouldn’t click a random link in a text message, don’t scan a random QR code either.

3) Preview links before opening

Most phones let you press and hold a QR code link to preview where it goes. If the URL looks suspicious, with misspellings, random numbers or shortened links, don’t open it. Taking a second to check can save you from a phishing trap. 

4) Limit your digital footprint

The less personal data available about you online, the harder it is for scammers to target you with convincing fraud attempts. Consider using data removal services that scrub your information from people-search sites and marketing databases. This reduces the chances that your address or phone number ends up in the wrong hands and is connected to a scam package.

While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

5) Enable two-factor authentication (2FA)

Even if your login details are stolen, 2FA makes it harder for criminals to access your accounts. By requiring a secondary code sent to your phone or generated through an authenticator app, 2FA helps prevent unauthorized logins to your banking, email and trading accounts.

6) Keep your device updated

Software updates often contain fixes for security vulnerabilities that scammers try to exploit. Running the latest version of your phone’s operating system, as well as updating apps regularly, gives you stronger protection against malware that can be delivered through a malicious QR code.

7) Report suspicious activity

If an unexpected package arrives at your door with a QR code inside, do not simply throw it away. Report it to local authorities and consider filing a complaint with the FBI’s Internet Crime Complaint Center. Reporting not only helps protect you, but it also gives law enforcement more information to track how these scams are spreading.

Kurt’s key takeaway

This scam might not be everywhere yet, but it shows just how quickly criminals adapt to new technology. QR codes were meant to make life easier, and most of the time they do, but that same convenience can turn into a weakness when people let curiosity override caution. The lesson here is that a mystery package with a QR code is not some fun puzzle to figure out. It is a red flag. The safest move is to step back, resist the urge to scan and if something feels off, report it instead of interacting with it.

Have you ever scanned a QR code without thinking twice about where it might lead? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com.  All rights reserved.