QRsafer Help
Package Tracking QR Code Scam: What to Do If You Scanned One
If you scanned a QR code from an unexpected package, stop before entering tracking, login, or payment details. Package-tracking QR scams often impersonate carriers, retailers, or customs pages to steal credentials, card details, or address information.
Updated April 7, 2026. If you only scanned it, your main goal is to avoid submitting anything. If you entered login or payment details, treat the incident as exposed and act right away.
Short Answer
A package tracking QR code can be a scam if it comes from an unexpected shipment or pushes you into a fake delivery, customs, or payment page. Close it, verify the shipment through the real carrier or store, and if you entered anything sensitive, protect those accounts immediately.
Unexpected package or insert
The package, card, or printed flyer asks you to scan for tracking, delivery confirmation, or account verification even though you did not expect the shipment.
Fake carrier or customs page
The destination imitates USPS, UPS, FedEx, DHL, Amazon, or customs processing but uses a domain or branding that does not match the real service.
Pressure to pay or act fast
Scam pages often demand a redelivery fee, customs payment, address confirmation, or urgent login before the package can be released.
Account or payment collection
Instead of showing normal shipment details, the page pushes for passwords, card numbers, phone verification, or wallet approval.
How the scam usually works
The scammer uses a package, card insert, fake delivery notice, or marketplace message to create urgency. Instead of telling you to verify the shipment through the retailer or carrier you already know, it asks you to scan a QR code to unlock tracking, reschedule delivery, fix an address issue, or release the package.
Once opened, the QR code can route you to a fake shipping portal or payment screen that looks believable enough to trust in a hurry. The goal is usually credential theft, payment fraud, or collecting personal information for follow-up scams.
What should you do if you scanned a QR code from an unexpected package?
- 1
Stop using the QR destination immediately. Do not rescan the code, retry the page, or approve any extra prompts.
- 2
Save the evidence while it is still visible: photos of the package or insert, screenshots of the QR page, the full URL, and any tracking or order references shown.
- 3
If you only scanned the code and did not submit anything, verify the shipment through the store account, shipping email, or carrier app you already trust.
- 4
If you entered login credentials, change that password immediately and rotate any reused passwords starting with your email account.
- 5
If you entered card details or approved a payment, contact your bank, card issuer, or wallet provider right away and ask them to block or monitor for fraud.
- 6
Report the scam to the retailer, marketplace, carrier, or property where the package appeared so the impersonation can be documented and other people can be warned.
How to verify a real delivery request safely
Check whether you were actually expecting the package, delivery update, or customs request.
Open the retailer or carrier app directly instead of trusting the QR code printed on the package or insert.
Compare the destination domain to the real carrier or store domain before entering anything.
Treat requests for small redelivery fees, urgent customs payments, or account logins as a scam signal until verified independently.
The safest fallback is simple: do not use the QR code at all. Open the real store or carrier app, sign in through the official site you normally use, and verify the shipment independently.
FAQ
What does a package tracking QR code scam look like?
It usually starts with an unexpected package, delivery notice, text, or printed insert that tells you to scan a QR code to track a shipment, confirm your address, reschedule delivery, or pay a fee. The QR code leads to a fake carrier, retailer, or customs page designed to steal logins, payment details, or personal information.
What should I do if I scanned a QR code from an unexpected package but did not enter anything?
Close the page and do not submit any information. Then verify the package directly through the retailer, shipping account, or carrier app you already trust instead of returning to the QR code.
What should I do if I entered login or payment details after scanning a package QR code?
Treat it as exposed immediately. Change the affected password, protect any reused accounts starting with email, and contact your bank or payment provider if card details or wallet information were submitted.
Are QR codes on unexpected packages ever legitimate?
Some businesses use QR codes for setup, returns, or product support, but an unexpected package or delivery problem should not force you to trust a new QR code. When the shipment is unfamiliar or the package seems suspicious, verify through the official store or carrier first.
Where should I report a package tracking QR code scam?
Report it to the carrier or retailer being impersonated, the marketplace or merchant if the package appears tied to an order, and your bank or payment provider if you entered billing details. You can also report delivery-themed fraud to the relevant consumer-protection or postal-inspection channel in your region.