Unordered package with a QR code scam
Some people receive packages they never ordered, with a note and a QR code to "find out who sent it" or claim a reward. The QR code leads to a page that steals your login and payment details.
How this scam works
Curiosity makes you scan. The fake page captures your account and card.
Common versions of the message
- A package you did not order
- A QR code to identify the sender
- A login with your account and payment details
What the message looks like
Text from Note inside package
This gift was sent to you by mistake. To find out who sent it and claim your free reward, scan the QR code and log in with your Amazon account and payment details.
Fictional example based on common, publicly reported scam patterns.
The red flags
- 1
Unordered package: “sent to you by mistake”
You do not have to return or pay for it
You can keep unordered merchandise sent to you. You do not have to pay for it.
- 2
QR code: “scan the QR code”
It leads to a page that steals your login
The QR code leads to a page made to steal your login.
- 3
Asks for your login: “log in with your Amazon account and payment details”
Never log in from a QR code in a package
Never log in from a QR code you did not expect.
What to do
- Do not scan the QR code.
- Check your real orders by opening the store app yourself.
- Change your password if you suspect your account was used.
If you already replied, clicked, or paid
- If you logged in, change your password and turn on two-step verification.
- If you entered card details, call the number on your card.
- Report it to the store whose name was used.
Got a message like this?
Paste it into TrustShield's free checker to see the warning signs in seconds. No sign-up needed to try it.