An unexpected parcel has a QR code. Should you scan it?

A note calls it a gift and says the code will identify the sender. Pause before you open the link.

Imagine a parcel arrives in your name, but you don’t recognize the sender. A note says it is a gift and asks you to scan a QR code to find out who sent it or how to return it. The U.S. Federal Trade Commission warns that a code like this could lead to a phishing page or download malware.

A printed QR image doesn’t tell you whether its destination is genuine. And if you didn’t order the parcel, there may be no delivery record to verify. The FTC article describes reports in the United States; procedures and reporting options vary elsewhere.

Try this first: Don’t scan the code. Check your shopping account and ask people in your household whether they ordered something. If you already entered a password, change it on the real service and turn on two-factor authentication. If you entered payment details, contact your bank or card issuer.

Receiving an unexpected parcel alone does not prove an account was hacked.

Sources: FTC, QR codes on unexpected packages; FTC, packages you didn’t order.