Is it safe to scan QR codes in hospital 'welcome baby' packets?

Mostly yes, but not automatically. Legitimate hospital welcome packets contain QR codes from known healthcare partners — infant formula brands, pediatric health apps, and insurance providers. The risk is that scammers have been known to place fraudulent inserts in public hospital waiting areas or mail them to new parents. Before scanning, check that the URL preview matches a recognizable brand's official domain. If anything asks for a Social Security number, insurance policy number, or full payment card details, stop and verify directly with your hospital or the brand's official website.

How do I know if a baby registry completion discount QR code is legitimate?

Check two things: the sending domain and the destination URL. Legitimate completion discount emails from Target, Amazon, or Buy Buy Baby come from those retailers' own domains (target.com, amazon.com, buybuybaby.com). The QR code should point to the same domain — not a lookalike like 'target-registry-offer.com' or a URL shortener. If you're unsure, open the retailer's app directly and look for the completion discount there rather than through the QR code.

What should I do if I scanned a fake 'car seat recall' QR code and entered my information?

Act quickly. If you entered a credit card number, call your bank immediately and request a new card. If you entered your email and name only, change the password on any account that uses that email address and enable two-factor authentication. If the page asked for your baby's name, date of birth, or your own SSN under the guise of a recall registration, consider placing a credit freeze — that data is enough to open fraudulent accounts. Report the incident to the CPSC (cpsc.gov) and the FTC (reportfraud.ftc.gov).

Can scammers target me before my baby is born?

Yes. Baby registries at major retailers are sometimes semi-public by design — friends and family need to find them. Scammers scrape registry data, including your name and due date, and send targeted phishing campaigns timed to your third trimester or due date. The content is designed to feel especially relevant: 'Your registry is almost complete,' 'Last chance for your newborn discount,' or 'Safety alert for a product on your registry.' The targeting makes the messages feel personal and therefore more convincing.

QR Code Scams Targeting New and Expectant Parents: What to Check Before You Scan

The weeks after a baby arrives are full of QR codes. Registry completion discounts. Formula samples. Parenting app promos. Hospital welcome packets. Each one feels like it belongs in that moment — which is exactly what makes it such a well-timed attack surface.

New parents are among the most-targeted victims of QR code scams. They are sleep-deprived, spending more than they ever have before, signing up for new services almost daily, and making many of these decisions on a phone at 2 a.m. That combination of urgency, trust, and distraction is the same formula that powers every other QR code scam — except here, the emotional stakes are even higher.

Here are the four main ways this plays out.

Fake baby registry completion discount QR codes

Major retailers — Target, Amazon, Buy Buy Baby, Babylist — send genuine completion discount offers to expecting parents: finish your registry and get 15% off everything remaining. These emails are real, and expecting parents look forward to them.

Scammers know this. They send convincing lookalike emails at the same moment in a pregnancy, using spoofed sender addresses and branding that matches the real retailer closely. The QR code in the email leads to a fake storefront that mirrors the retailer's checkout page and asks for your payment details.

The difference from a real retailer email is in the URL. A legitimate email from Target points to target.com. A scam email points somewhere like target-registry-savings.com or uses a URL shortener that hides the real destination. Before scanning, long-press the QR code to preview the URL, or use QRsafer to check the destination before your browser opens it.

If you received a completion discount QR code, the safest path is to open the retailer's app directly and find the offer there — not through the email.

QR codes in hospital "welcome baby" packets

Most maternity wards give new parents a welcome bag or folder: information on lactation support, newborn care, pediatric scheduling, and often product samples from formula brands, diaper companies, and parenting apps. These inserts sometimes include QR codes.

The scam version of this exploit is subtler. Fraudulent inserts are placed in hospital waiting areas, slipped into welcome bags before staff review them, or mailed to new parents using data purchased from data brokers. They typically pose as a well-known formula or baby product brand and offer a free sample or "new parent kit" in exchange for filling out a form.

The form asks for your baby's name, date of birth, and your health insurance information — framed as necessary to "personalize" the sample. That data is more than enough to file fraudulent insurance claims.

Legitimate formula samples and new-parent kits from brands like Enfamil or Similac are distributed through hospitals and pediatricians directly — they do not ask for insurance details to send a sample. If a form requests that, close it and verify through the brand's official website.

Parenting app QR codes in social media ads

New and expecting parents are a heavily advertised demographic on every social platform. Legitimate apps — sleep trackers, feeding loggers, pediatric telehealth services — do advertise via QR codes on social media, which is exactly why fake ones blend in so well.

Fraudulent parenting app QR codes fall into two types: those that lead to a fake app download page (where the app itself is a credential stealer or adware), and those that lead to a phishing page posing as a subscription sign-up where your credit card is collected for a "free trial" that bills you repeatedly.

Before installing any app from a social media QR code, search for it directly in the App Store or Google Play. Check the developer name, total download count, and recent reviews. If the app doesn't appear in a direct search, or if reviews mention unexpected charges, don't install it.

Fake "car seat recall" or "safe sleep certification" QR codes

This variant is the most emotionally manipulative. A notification arrives — by text, email, or physical mail — claiming that a car seat, crib, or baby product on your registry has been recalled and that you need to scan a QR code immediately to receive a replacement or register for a refund.

Fear and urgency are the tools here. A parent who just buckled their infant into a car seat they now believe is unsafe will act fast. The QR code leads to a page that asks for the product's model number (harvesting purchasing data), your shipping address, and a credit card to "cover the cost of return shipping."

No legitimate product recall requires a credit card. Real safety recalls are administered through the Consumer Product Safety Commission (CPSC) at cpsc.gov. If you receive a recall notice with a QR code, go to cpsc.gov directly and search for the product — do not use the QR code in the notice.

What to do if you already scanned one

If you scanned a suspicious QR code and entered information:

Credit card number: Call your bank immediately, report potential fraud, and request a replacement card.
Email and name only: Change your email password and enable two-factor authentication. Monitor your inbox for follow-on phishing attempts.
Insurance information: Contact your insurer and flag the exposure. Ask to be notified of any new claims filed.
Baby's date of birth or SSN: Consider placing a credit freeze for yourself and, if an SSN was shared, consult your insurer or a fraud specialist about what's possible for a minor.

The full step-by-step recovery guide is at what to do if you scanned a suspicious QR code.

How QRsafer helps

QRsafer previews the destination URL of any QR code against threat intelligence feeds before your browser loads the page. You get a verdict — Safe, Risky, or Dangerous — in seconds. Freshly registered phishing domains, lookalike retail URLs, and known scam pages are flagged before you have a chance to type anything.

The scan takes less time than reading this sentence. That's the right tradeoff when you're tired and moving fast.

Quick checklist for new parents

Registry completion discount by email? Open the retailer's app directly instead of scanning the QR code.
QR code in a hospital packet or sample insert? Verify the brand's official site before submitting any insurance or personal data.
Parenting app from a social media ad? Search the App Store or Google Play directly before installing.
Product recall notice with a QR code? Check cpsc.gov first — never pay to participate in a recall.
Any QR code you're not sure about: Use QRsafer to preview the destination before the page opens.

Nobody should have to think about this during the first weeks home with a new baby. QRsafer makes the check fast enough that you don't have to.