A warning about unsolicited parcels
In a warning published on 31 July, the FBI describes unsolicited deliveries accompanied by QR codes. A lack of sender information can encourage the recipient to scan in search of an explanation. The resulting journey leads them to provide personal or financial data, or to download malicious software.
The agency says this fraud is less widespread than other scams. Its warning therefore does not establish a wave affecting all parcels, or mean every unexpected gift is fraudulent. The decisive point remains the request that accompanies the delivery.
The gift becomes a pretext for requesting data
The method extends “brushing”. In its usual form, a seller ships an unordered item and then uses the recipient’s details to post a positive review. The QR variation adds another step: getting the person to take part in a process that appears to explain the gift.
In January, the FTC had already described messages offering to identify the sender or provide return instructions. In February, the US Postal Inspection Service also discussed registering a gift. These scenarios share a feature: an apparently harmless service becomes a reason to enter information.
Check the parcel through an independent route
Start with your orders and people who might have sent you a gift. If a carrier or shop is named, open its usual app or known website. A tracking reference may help you ask customer service a question; the parcel’s QR code need not become your entry point.
A page asking for a bank card, password or installation to reveal a sender’s name is a reason to stop. A displayed logo and your address on the parcel do not authenticate that page. The guide to unexpected destinations explains the distinction between QR content and the page eventually opened.
After scanning, distinguish what actually happened
Reading the code, opening a link, entering credentials and installing an app are different actions. If you supplied a password, change it through the official service and review account access. If you supplied payment details, contact your bank through its usual channel. Keep a record of the parcel and the request you received.
To understand an image already in your possession, the Qurl reader can display QR content without automatically opening its destination. This helps you read an address; it does not certify the sender or the site’s safety. The QR security guide explains useful checks.