Delivery QR codes are everywhere now: return labels, package lockers, carrier receipts, delivery notices, product inserts, and seller messages. Some are useful. Some are fake payment pages designed to catch you when you are worried about a missing package.
The safest way to think about delivery QR codes is simple: a code generated inside an official carrier or retailer account is usually lower risk. A code that arrives unexpectedly and asks for money, login details, or personal information deserves a full stop.
Delivery QR risk by scenario
| Scenario | Usually safer when | Higher risk when | |---|---|---| | Carrier tracking | You opened the carrier app or typed the carrier site yourself | A text or email says to scan now to avoid return or disposal | | Package insert | It points to the brand's official site for instructions or registration | It promises a prize, refund, warranty, or coupon on an unfamiliar domain | | Return label | It appears inside your Amazon, retailer, UPS, FedEx, or USPS account | A seller sends it through chat and asks you to leave the normal return flow | | Locker pickup | The code appears in the official locker app, kiosk, or carrier message you requested | A stranger sends a code for a pickup, refund, or "verification" | | Delivery fee | The amount and tracking number match the official carrier account | The message demands a small fee by QR code before a package can move | | Refund or replacement | You started the return in the official account | A QR page asks for new card details to "release" money |
1. Carrier text and email lures
The most common delivery scam starts with a text or email. It claims a package is held because of an address problem, customs fee, redelivery fee, unpaid postage, or failed delivery attempt. The QR code opens a page that imitates USPS, UPS, FedEx, Amazon, or a regional courier.
Red flags:
- the message was unexpected
- the sender is a regular phone number or odd email address
- the QR code hides the URL until you scan
- the page asks for a small card payment before showing real tracking details
- the domain is not the carrier's official domain
If you are unsure, skip the QR code. Open the carrier app or type the tracking number into the official website yourself. For carrier-specific examples, see USPS QR code scams, UPS QR code scams, and FedEx QR code scams.
2. Package inserts and warranty cards
Package inserts can be legitimate. Brands use QR codes for manuals, warranty registration, setup videos, and support pages. Scammers and shady sellers use the same format for fake prizes, review manipulation, refund forms, and data-harvesting pages.
Treat a package insert as higher risk when it:
- promises a gift card, refund, or rebate that was not part of the purchase
- asks for a card number to "verify" a free item
- sends you to a domain unrelated to the brand
- asks for marketplace login credentials
- says you must scan quickly before the offer expires
Use the guide on QR codes on package inserts for a deeper checklist, especially if the insert came from an online marketplace seller rather than the brand itself.
3. Return labels and refund QR codes
Return QR codes are normal when they are created inside an official account. Amazon, carriers, and many retailers use QR codes for drop-off returns, locker pickups, and label-free returns.
The risky version happens when the code appears outside the normal return path. A seller may send a QR code by chat. A fake email may claim your refund is waiting. A page may ask for your card details to "receive" money, which is backwards: refunds usually go back to the original payment method.
Before scanning a return QR code:
- start from your official order history
- confirm the item, merchant, and return window
- check that the destination matches the retailer or carrier
- do not enter new card details for a refund
- avoid seller-provided links that move you off the marketplace
Related pages: QR code on a return label and Amazon return QR code scam.
4. Pickup lockers and delivery kiosks
Locker QR codes are usually tied to a specific order, pickup code, or carrier app. They become risky when someone sends you a QR code for a pickup you did not request or a kiosk screen asks for unexpected payment.
Use these checks:
- Does the code match an order in your official account?
- Does the locker brand match the message?
- Is the pickup location the one you selected?
- Does the page show a real tracking or order number before asking for anything?
- Can staff or the carrier app verify the pickup another way?
For broad pre-scan guidance, see are QR codes on packages safe?.
What to do if you already scanned
If you only scanned and closed the page, your risk is usually low. The bigger concern is what you entered or approved after the page opened.
- Save the original message, QR image, URL, screenshots, and any receipt.
- Open the carrier or retailer account directly and check the real package status.
- If you entered a card, call the card issuer and request monitoring or replacement.
- If you entered a password, change it directly on the real account and sign out other sessions.
- Report the fake message to the carrier, retailer, marketplace, and your mobile carrier if it came by text.
For a full recovery workflow, keep what to do if you scanned a suspicious QR code handy.
See also
- How to Spot a Malicious QR Code Before You Scan
- QR Code Threat Map
- Package Tracking QR Code Scam
- QR Code on a Package Insert: Is It Safe?
- Are QR Codes on Packages Safe to Scan?
Before opening a delivery QR code from a text, insert, return label, or locker, preview it with QRsafer. Download it for iOS or Android.
Frequently asked questions
Are package delivery QR codes safe to scan?
Many package QR codes are safe when they come from an official carrier app, receipt, locker screen, or account page. Be more cautious with unsolicited texts, emails, package inserts, refund pages, and payment demands that use unfamiliar domains.
What is the biggest red flag in a delivery QR code scam?
The biggest red flag is urgency tied to payment or personal information: a message saying your package will be returned, held, or destroyed unless you scan a QR code and pay a small fee.
What should I do if I entered card details on a fake delivery QR page?
Save the message, QR image, URL, and receipt, then call your card issuer and explain that you entered details on a suspected fake delivery page. Also report the message to the carrier through its official fraud-reporting channel.
Can QRsafer check delivery QR codes before they open?
Yes. QRsafer previews the destination and checks suspicious links before your browser opens them, which is useful for delivery texts, package inserts, locker codes, return labels, and carrier payment pages.