You Got a Package You Did Not Order, and It Has a QR Code

It arrives on an ordinary weekday. A padded envelope or a small box, addressed to you correctly, containing something cheap and slightly baffling — a phone ring holder, a silicone kitchen gadget, a bracelet, a packet of seeds. No invoice. No sender. Sometimes a card: Scan the QR code to see who sent your gift, or Scan to register your free item, or Scan to arrange your return.

You did not order it. Nobody you know admits to sending it. The obvious question is who did, and the card offers to answer it in one scan.

Do not take that offer. But "do not scan it" is where almost every warning about this stops, and it is not actually the most useful thing anyone can tell you. The package itself is evidence of something that already happened, the code is a second and separate attack, and the two need different responses.

The Short Answer

• The package is a brushing scam. A seller shipped you something cheap so they could post a review in your name that a marketplace will mark as a verified purchase.
• The QR code is a phishing hook bolted onto that scheme. It leads to a page built to harvest identity or payment details, or to push an app install from outside the official store.
• Your address was already exposed before the parcel shipped. That is the finding worth acting on, and it is unaffected by whether you scan anything.
• You can keep the item. In the US, the UK and the EU, goods you did not order are yours, and you owe nothing for them.
• Scanning is only dangerous if your scanner opens the link for you. A code is a string of text. Reading the string is safe; visiting it is the risk.

What a Brushing Scam Is, and Why the Package Came to You

Marketplaces rank products partly by review volume, and weight reviews attached to a confirmed order far more heavily than free-floating ones. That creates a market for confirmed orders. A seller buys their own product, ships it to a real name at a real address, and the platform records a genuine delivery. The seller then writes a glowing review from an account tied to that order.

The recipient is incidental. You were picked because your name and address appeared together in a list the seller could obtain — a leaked customer database, a scraped public record, a data broker's file, an old breach recycled into a fresh package. The item is cheap because it is a cost of doing business: it buys a review, and reviews sell products.

This is why the parcel matters even if you throw it straight in the bin. It is a receipt. Somebody, somewhere, has a working record of where you live, and it is circulating in a market where it is worth spending a few pounds or dollars per name.

What Changed: the Card With the Code

Brushing on its own does not make the sender any money directly. It is an advertising expense. So the scheme acquired a second stage: since a package is already going to a verified real person who is going to be curious about it, put something in the box that monetises that curiosity.

The FBI's Internet Crime Complaint Center issued a public service announcement on this specific pattern on 31 July 2025 — Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes, alert number I-073125-PSA. It describes criminals shipping unsolicited packages containing a QR code that prompts the recipient to hand over personal and financial information, or to download software that steals data from the phone, and notes that packages are often sent deliberately without sender details precisely to make the code the only apparent way to find out who sent it.

The US Federal Trade Commission published a consumer alert on brushing scams in August 2026 making the same connection, and the US Postal Inspection Service has issued its own quishing advisory. Local police forces on both sides of the Atlantic have run the warning through 2025 and 2026. This is not a hypothetical.

It is also part of a broader movement of phishing onto printed codes. Action Fraud, the UK's national fraud reporting centre, recorded a 587% rise in QR-code phishing reports between 2023 and 2025. The reason is not that QR codes are technically clever. It is that a printed code is opaque to a human and invisible to an email filter, and it moves the victim from a monitored corporate laptop onto a personal phone.

What the Code Actually Does

A QR code is a way of writing text so a camera can read it. It cannot execute anything. What it contains is almost always a URL, and everything that follows happens because a browser opened that URL and a person then acted on what they saw. In the packages that have been reported, the destination falls into a small number of patterns.

That last row is the one people underestimate. A unique code per package turns a scan into a signal: this name, at this address, opens things. Lists of people who respond are worth more than lists of people who might.

Not Every Code in a Box Is an Attack

Warnings that say "never scan a QR code in a package" are easy to write and quietly useless, because legitimate parcels contain QR codes constantly. Returns labels are QR codes. Warranty registration is a QR code. Assembly instructions, spare-parts lists, appliance manuals and the little card in a new pair of headphones telling you to download the companion app are all QR codes. A blanket rule you will break next week is not a rule.

The distinction that actually holds is not whether there is a code. It is whether you can account for the parcel.

• You ordered it, from a retailer you recognise, and the packaging matches. The code is almost certainly what it says it is.
• You did not order it, and there is no sender. Treat the code as hostile. A real company that wants you to register a product tells you which company it is on the same card.
• You did not order it, and it names a sender you recognise. Go to that company the way you normally would — type the address, open the app you already have — and ask. Do not use the code, the phone number or the link on the card, because in an impersonation those are the parts that are fake.

A genuine QR code has nothing to hide about where it goes. The problem is that you cannot see where it goes by looking at it, which brings us to the part that is genuinely useful.

How to Read a Code Without Going Where It Points

Here is the distinction almost every article about this gets wrong. Decoding a QR code and visiting the URL inside it are two separate acts. The danger lives entirely in the second one. What has collapsed them together is that phone cameras, by default, do both at once: point, tap the banner, and you are on the page before you have read the address.

So the safe procedure is not to avoid the code. It is to break the two steps apart.

1. Decode it with something that shows you the text first. A scanner that displays the raw contents and waits for you to decide turns an opaque square into a readable line of text.
2. Read the domain, right to left. The real destination is the last two labels before the first single slash. In amazon.co.uk.parcel-track.info/claim the site you would visit is parcel-track.info, and the brand is decoration.
3. Be suspicious of a shortener. A short link on a printed card in an anonymous parcel is hiding the destination from you specifically, since the card was printed once and could have carried the real address.
4. Do not visit it to check. If it looks wrong, that is your answer. Curiosity is what the card is selling.

If you have already decoded the code and are holding the text, our QR code link checker takes it apart in your browser without opening, following or uploading anything. It splits out the real host, flags the tricks that make one domain look like another, and tells you when the payload is not a link at all. For the wider set of signs to look for on physical codes, our guide to spotting fake QR codes covers the sticker-over-sticker and fake-menu variants you are more likely to meet in the street than in a parcel.

What To Do About the Package

Work through this in order. The item is the least urgent part.

1. Do not scan the card, and do not reply to anything in the box. Set it aside rather than binning it if you intend to report it — the packaging carries the tracking barcode and any sender details there are.
2. Check the accounts that hold your address. Look at the order history on every marketplace you use. A brushed order is usually placed on the seller's own account, not yours, but reviews posted in your name are a sign your account itself was reached. If you find one, change that password and turn on two-factor authentication.
3. Check whether your details are in a known breach. Your address travelled with your name from somewhere. Assume the pairing is circulating and treat future messages that quote it as unverified rather than trustworthy.
4. Watch for the follow-up. The parcel makes a later approach more convincing: a caller who knows what was delivered sounds like the company that delivered it. Treat any contact referencing the package as unsolicited, whatever it knows about you.
5. Report it. In the US, to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov, which asked specifically for reports of this pattern. In the UK, to Action Fraud. In the EU, to your national consumer protection authority. Also report it to the marketplace named on the packaging — they act on brushing, because fake reviews damage them directly.
6. Then deal with the item. Keep it, give it away, or dispose of it. Only handle it with a little care if it is something ingestible or applied to skin: an unsolicited cosmetic or supplement from an unidentified sender has no provenance at all.

If the packaging carries a barcode and you want to know what the item actually is before deciding, our guide to looking up product information from a barcode covers what a product code can and cannot tell you — which is less than most people assume.

Can You Keep It? Yes, and the Law Is Unusually Clear

This is one of the few consumer questions with a genuinely simple answer in several jurisdictions at once, though the instrument differs.

The practical consequence is that any message telling you to pay for the item, return it at your own cost, or scan a code to "cancel the order" is itself a further attempt on you. There is no order to cancel. Where a summary and the statute disagree, the statute governs, and anything with real money at stake deserves qualified advice rather than an article.

Why This Keeps Working

Every effective element of this scheme is borrowed from something legitimate, which is what makes it hard to teach people to spot.

The parcel arrives through a real courier with real tracking. It is addressed correctly, because the data is real. The card in the box uses the same visual grammar as the registration card in a genuine product. The QR code looks exactly like the one on your last takeaway menu, because there is only one way for a QR code to look. And the question it offers to answer — who sent me this? — is a reasonable question that has no other easy answer, which is precisely why the sender details were omitted.

None of the individual signals are wrong. The scheme works by assembling ordinary parts into a situation where scanning feels like the sensible thing to do. That is why the advice worth internalising is procedural rather than perceptual: not "learn to recognise a bad QR code", which is impossible, but "always read the destination before you visit it". That habit costs nothing and covers the parking meter, the restaurant table and the email attachment as well as the parcel.

Frequently Asked Questions

Can scanning a QR code hack my phone?

Not by itself. A QR code is stored text, and decoding it does no more than reading a line of print. What creates risk is what happens next: a browser opening a phishing page, an install prompt for an app from outside the official store, or a payment form you fill in. The reason scanning feels dangerous is that phone cameras usually decode and open in a single tap, so the two steps happen too fast to separate. A scanner that shows you the text and waits removes that.

I already scanned it. What now?

If you only landed on a page and closed it, the realistic exposure is that the sender now knows the address is live. Nothing further is needed beyond expecting more contact. If you entered anything, act on what you gave: change that password and enable two-factor authentication if it was credentials, contact your bank if it was card details, and watch for password-reset messages you did not request. If you installed an app, remove it, and on Android also check for any app holding accessibility or device-administrator permissions.

How did they get my name and address?

Almost always from a list rather than from you directly — a breached retailer database, a data broker's file, scraped public records, or an old leak resold. You will rarely be able to trace which. The useful assumption is that the pairing of your name and address is in circulation, so a stranger knowing it proves nothing about who they are.

Should I return the package?

No. There is no order to reverse and no legitimate sender to return it to, and a "return" QR code on the card is one of the standard hooks. Under US, UK and EU rules you have no obligation to return unordered goods or to pay for their return.

Is it dangerous to open the package at all?

Opening it is not the risk; acting on what is inside is. The reported pattern is cheap consumer goods plus a printed card, not anything hazardous. The one sensible caution is to leave unsolicited cosmetics, supplements or food alone, because an item from an unidentified sender has no traceable supply chain behind it.

Why would anyone spend money sending me a free product?

Because the review is worth more than the item. A review attached to a confirmed delivery is treated as a verified purchase and carries far more weight in marketplace rankings than an unverified one, so a few pounds of cheap goods and postage buys ranking that would otherwise cost far more in advertising. The QR code was added later to earn something directly from the same shipment.

Does a QR code in a package ever mean something legitimate?

Frequently. Returns labels, warranty registration, manuals, spare-parts lists and companion-app downloads are all delivered as QR codes in ordinary parcels. The signal is not the code, it is whether you can account for the delivery. A parcel you ordered from a retailer you recognise is a different situation from an anonymous one with no sender.

Can I find out who sent it without scanning?

Sometimes, and never through the card. The shipping label carries a tracking number, and the courier's own website or app — reached by typing the address yourself, not through any link in the box — will show where the parcel originated. The marketplace named on the label can also trace it, and has a reason to, since brushing is a policy violation on every major platform.

Are these codes dynamic, so they can change later?

Often, yes. A short link can be repointed after printing, which lets a card sit harmlessly for weeks and turn hostile once enough have shipped, and it makes takedowns harder. Our guide to static versus dynamic QR codes explains the mechanism. It is another reason a printed short link deserves more suspicion than a full address, not less.

The Short Version

The parcel is a brushing scam, the card is a phishing attempt attached to it, and the durable problem is neither of those but the fact that your name and address were sitting on a list somewhere before either arrived. Keep the item — it is legally yours in the US, the UK and the EU. Report the parcel to the marketplace and to your national fraud body. Then treat everything that follows, especially anything that already knows what was delivered, as a stranger's claim rather than a company's.

And keep the habit rather than the rule. Codes are not going away, and most of them are fine. What protects you is never the ability to spot a bad one by looking at it. It is refusing to visit any destination you have not read first.