A Package You Didn't Order Arrived With a QR Code. Don't Scan It.

What it is

A box shows up. You didn't order it. No sender name, just a note asking you to scan a QR code to "find out who sent it" or "process a return." That's not a mix-up — it's a scam, and the FBI and IC3 formally warned about this exact setup in July 2025. Criminals ship these packages for one reason: to get you to scan that code.

It's a QR twist on the older "brushing" scam. In the classic version, a seller ships cheap merchandise you never asked for, then uses your name to post a fake verified-purchase review and inflate their listing's ratings. Add a QR code, and there's a second payoff on the table: get you to scan, and now they've also got a shot at your credentials or your phone.

How it actually works

The setup is simple. A package arrives addressed correctly to you, but with no return address and nothing to match it to an actual order. Inside, a printed note frames the code as helpful — "scan to see who sent this gift," maybe "scan to arrange your free return." There's no other way offered to get that information. That's by design.

Scan it, and the code can route you to a phishing page built to collect credit card numbers, usernames, and passwords. Or it pushes an app install that hands an attacker ongoing access to whatever's on the phone — not just a one-time credential grab.

Curious how this compares to other scan-related traps? Is It Safe to Scan a QR Code? covers sticker overlays, fake login prompts, and malicious redirects beyond the mailbox.

Where you'll see it

This one travels by mail or courier, not by sticker — and that distinction matters. A fake QR code taped over a parking meter tampers with a real, trusted code, so there's a legitimate version nearby to compare against. An unsolicited package skips that step entirely. The box, the note, and the code are all fabricated from scratch, built to arrive looking like nothing's wrong.

Even the FBI's read on it is measured: the bureau calls it "not as widespread as other fraud schemes," but serious enough to warrant a formal alert.

Tips, gotchas, and a quick how-to with QRDock

Start with the legal baseline: you're under no obligation to pay for, return, or even open something you didn't order. Keep it, toss it, whatever — that choice is yours either way, scan or no scan.

The simplest defense here isn't clever, it's just boring: don't scan a code that showed up from a stranger in a box you didn't order. No legitimate retailer needs a scan to tell you who shipped your own purchase — that's already sitting in your order history and email confirmations.

Not sure about a code before you commit to opening whatever it points to? A scanner that previews the destination link and flags risk before loading the page lets you look at the URL without fully committing — that's the check QRDock builds in.

Already scanned it and typed something in? Change that password now, everywhere you reused it, and turn on two-factor authentication. Pull a free report at AnnualCreditReport.com and check your statements for anything unfamiliar. Then report the package to ReportFraud.ftc.gov or ic3.gov so the pattern gets tracked.

Frequently Asked Questions

Do I have to pay for or return a package I never ordered?

No. Federal law treats unsolicited merchandise as a gift — you can keep it, and you're not obligated to pay for it or ship it back, regardless of what any note inside says.

I already scanned the QR code. What should I do now?

If you entered a username or password on the page it opened, change that password immediately on every account that reuses it and turn on two-factor authentication. Pull a free credit report at AnnualCreditReport.com, watch your card and bank statements for unfamiliar charges, and consider a credit freeze or fraud alert if anything looks off.

How is this different from a QR code taped over a parking meter or menu?

A sticker-overlay scam tampers with a real, trusted code in public. This one has no legitimate original — the entire package, note, and code are created by the scammer from the start, so there's nothing to visually compare it against.

Can a QR code actually install malware just from scanning?

Yes. Some of these codes route to a page that prompts an app install or a permissions grant; accepting it can hand an attacker ongoing access to data on the phone, not just a one-time credential.

Conclusion

An unmarked box with a "scan me to find out who sent this" note isn't a puzzle worth solving — it's a scam dressed up as one. The package itself is harmless to keep, toss, or ignore; the code is the actual trap, and skipping it costs you nothing. As brushing operations keep testing new hooks, the rule doesn't change: don't scan codes from people you don't know, whatever story comes attached.