FBI warns about the QR code scam disguised as mysterious packages

The QR codes that were once seen as a convenient shortcut to verify the menus or pay invoices have become increasingly weapons. False delivery texts, counterfeit payment links and malicious codes attached to the legitimate have become part of the modern fraud play book.

The last warning of federal authorities shows how far these tactics have come. The criminals are now sending packages that people never ordered. Within these boxes there is a QR code that, when scanning, can lead to stolen personal details, drained bank accounts or malware that are executed silently at the bottom of a phone.

Register for my free Cyberguy report
Get my best technological tips, urgent security alerts and exclusive offers delivered directly to your inbox. In addition, you will get instant access to my best scam survival guide, free when you join me Cyberguy.com Information sheet.

QR code scams increase when 73% of Americans scan without verifying

What you need to know about the QR code scam

The scheme is a turn in what is known as brushing fraud. Traditionally, brushing scams involved online vendors who sent products to strangers and then using the recipient’s details to publish false criticism. It was more a nuisance than a serious crime.

Now the practice has changed free elements harmless to deliberate fraud. Instead of receiving a product, many victims find only a printed QR code. Once scanned, the code redirects fraudulent websites to request confidential personal information, such as bank information, credit card numbers or login credentials. Some codes go one step further and install malicious software designed to track the activity and steal data directly from the device.

“The FBI warns the public about a variation of fraud in which criminals send unre requested packages that contain a QR code that requests the recipient to provide personal and financial information or download without knowing it software that steals data from their phone,” the agency said in a public notice. “To encourage the victim to scan the QR code, criminals often send packages without information from the sender to attract the victim to scan the QR code.”

WhatsApp Bans of 6.8m Scam accounts, launches a safety tool

Why the QR codes appeal to the scammers

QR codes have become common in everyday life. They are used in restaurants, stores, airports, in surveys and payment systems and most people scan them without thinking twice. Unlike the suspicious links that can be seen, a QR code does not reveal anything until it scan.

That makes it a perfect costume for a scam. The configuration is simple: a package comes without information from the sender and without explanation. The mystery causes curiosity, and many people scan the code to discover who sent it. That moment of curiosity is what the scammers trust.

The consequences can be serious. False websites can reap names, addresses and financial details. Malware can monitor the accounts in silence, record the keys of keys or even direct cryptocurrency wallets. The victims often do not realize until they see unauthorized charges or suspicious retreats. By then, your information may already be in the hands of criminals.

Do not fall in this bank

7 ways to stay safe from QR code scams

The scammers trust in curiosity and convenience to deceive people to scan malicious QR codes. Some simple habits can help you become a goal. Here are seven ways to stay safe from QR code scams.

1) Be careful with the unplayed QR codes and use strong antivirus software

Avoid scanning QR codes of mysterious deliveries, random flyers or stickers in public signals. A QR code is just a disguised link, and until you know where it leads, it should not be trusted. To stay safe even if a risky code accidentally scan, keep solid antivirus software on your phone. Mobile safety applications can block fraudulent sites, warn you before downloads and protect against malicious QR attacks.

Get my choices for the best 2025 antivirus protection devices for your Windows, Mac, Android and iOS devices in Cyberguy.com.

2) Stick in sources of trust

Just scan the QR codes of companies and organizations that already trust. The examples include your bank’s mobile application, an airline boarding pass or a paid page of the known retailer. If you do not click on a random link in a text message, do not scan a random QR code.

3) Preview links before opening

Most phones allow you to press and maintain a QR code link for a view of where you are going. If the URL seems suspicious, with spelling errors, random numbers or shortened links, do not open it. Taking a second to verify can save it from a phishing trap.

4) Limit your fingerprint

The less personal data are available on you online, the more difficult it will be for scammers who go to you with convincing fraud attempts. Consider the use of data elimination services that rub your information from the search sites of marketing databases and databases. This reduces the possibilities that your address or telephone number ends in the wrong hands and is connected to a package of scams.

While no service promises to eliminate all its Internet data, having an elimination service is excellent if you want to constantly monitor and automate the process of eliminating your information from hundreds of sites continuously for a longer period of time.

5) Enable two factors’ authentication (2FA)

Even if your login details are stolen, 2fa It makes it more difficult for criminals to access their accounts. When requiring a secondary code sent to your phone or generated through an authenticator application, 2FA helps avoid unauthorized session in your bank accounts, email and trade.

6) Keep your updated device

Software updates often contain solutions for security vulnerabilities that scammers try to exploit. Execute the latest version of your phone’s operating system, as well as update applications regularly, gives you stronger protection against malware that can be delivered through a malicious QR code.

7) Inform suspicious activity

If an unexpected package reaches its door with a QR code inside, not just have it. Report to the local authorities and consider submitting a complaint before the FBI Internet Crimes Complaints Center. Informing not only helps protect it, but also gives the police more information to track how these scams are extending.

Click here to get the News application

Kurt key takeway

It is possible that this scam is not yet everywhere, but it shows how quickly criminals adapt to the new technology. QR codes were destined to facilitate life, and most of the time they do, but that same convenience can become a weakness when people let curiosity annul caution. The lesson here is that a mysterious package with a QR code is not a fun puzzle to solve. It is a red flag. The safest movement is to step back, resist the impulse to scan and if something feels off, reprost it instead of interacting with it.

Have you ever scanned a QR code without thinking twice before where could you drive? Get us knowing in Cyberguy.com.

Register for my free Cyberguy report
Get my best technological tips, urgent security alerts and exclusive offers delivered directly to your inbox. In addition, you will get instant access to my final scam survival guide, free when I join me Cyberguy.com Information sheet.

Copyright 2025 Cyberguy.com. All rights reserved.