Start by placing yourself in one of three states
A QR code on a package you did not expect — a mystery sender, a “return” or “redelivery” label, a note asking you to confirm an address — is a link you did not request. The useful question is not “is this package real?” but “how far did this code get into my accounts?”
Use this table to find your state before doing anything else.
| State | What happened | What to do first |
|---|---|---|
| A. Unopened | You have the package or label, but have not scanned the code | Do not scan it to “see what it is.” Keep the packaging and note the sender text, date and carrier markings |
| B. Scanned only | The code opened a page or app prompt, but you did not type a password, code or card number | Close the page. Do not enter anything. Check the account the page claimed to represent through its official app or a bookmark you already have |
| C. Credentials entered | You typed a password, one-time code, card number or other login details after scanning | Treat the account as exposed and move to the recovery steps below |
Do not scan the code as a test, even on a spare device. A scan is exactly the step that loads the page.
State A: the code is still unscanned
You do not need to identify the sender to protect yourself. You need to avoid using the printed route.
- Do not scan the code and do not open any short link printed beside it.
- Keep the packaging and label. Photograph the label, the sender line and any tracking number. This is for your own records, not proof that the sender is legitimate.
- Check for a delivery you actually ordered. Use the carrier’s or retailer’s app or a site you navigate to yourself, not the phone number or link on the label.
- If the parcel is genuinely unexpected and you cannot match it to an order, treat it as unsolicited. What you may do with it depends on where you live; this article does not give legal advice for any country.
- Report it if you want to. In the US, the FTC publishes consumer guidance on scam texts and packages. Reporting routes differ by country, so use your local consumer authority rather than assuming a US process applies.
A package that arrives without a matching order is not automatically a crime, and a QR code is not automatically malicious. The point is that you cannot tell from the label alone, so you do not need to take the risk to find out.
The FTC warns that a QR code on an unexpected package may lead to a phishing website that steals login or payment information, or to malware. Source
State B: scanned, but nothing entered
If the code opened a page and you stopped before typing anything, your main job is to confirm the real account state through a route you control.
- Close the page or app prompt. Do not “log in to cancel” or “confirm the delivery” on the page the code opened.
- Open the service’s official app, or type its address yourself in a new browser tab. Do not reuse the link from the scan.
- Check whether the claimed event exists. If the page said a parcel was held, look for the same notice inside the carrier’s or retailer’s own account area. If nothing is there, the page was not a real notice.
- Do not install anything the page offers. An app install prompt from a package QR code is not a delivery requirement you can verify.
- Write down what the page asked for — password, card number, one-time code, delivery fee — so you can describe it accurately if you report it.
Scanning alone does not prove your accounts were accessed. The risk in this state is what you do next, so the safe next action is to stop using the printed route.
State C: credentials were entered
This is the state that needs action, and the order matters.
If account credentials were entered after scanning such a code, the FTC advises changing the password and enabling two-factor authentication. Source
Work through these steps in order, using the account’s own app or a page you navigate to yourself:
- Change the password from the official app or site, not from the page the code opened.
- Turn on two-factor authentication if it is not already on. Prefer an authenticator app or a hardware key over SMS where the account offers it.
- Change the same password anywhere you reused it. A password typed into a phishing page should be treated as known to someone else.
- If you entered card or bank details, contact the card issuer or bank using the number on your card or its official app. Do not use a number or link from the package or the scanned page. This article does not promise that a payment can be reversed.
- Keep access to your recovery method until you have finished. Do not remove your email, phone number or recovery codes before the password change and two-factor setup are confirmed working, or you can lock yourself out.
- Review recent account activity in the official app: sign-in locations, connected apps, forwarding rules and payment methods. Undo anything you do not recognize.
Removing a login connection or editing a profile is not the same as deleting stored data. If you are closing an account entirely, follow the provider’s own closure process and keep a working recovery method until closure is confirmed.
Use known account routes, not the printed code
A package label can print any address, phone number or QR code. It cannot prove who owns the destination. For any account decision — password reset, delivery confirmation, payment, refund — start from a route you already trust:
| Task | Trusted starting point |
|---|---|
| Confirm a delivery | The carrier’s or retailer’s app, or an address you type yourself |
| Reset a password | The service’s official app or site, or its documented account-recovery flow |
| Check a payment | Your bank or card issuer’s app or the number on your card |
| Report a suspicious message | Your local consumer protection authority; in the US, the FTC’s published guidance |
If a message claims to be from a support account and asks you to move the conversation to a chat app or to “verify” by logging in, the same rule applies: confirm through the service’s own app. For that separate situation, see checking fake customer support social accounts.
A public username match is a lead, not proof of ownership. If you are trying to identify who is behind a handle that contacted you, a username lookup such as TraceSeek can show where a handle appears on 3,000+ platforms, but it does not change account settings, issue recovery codes, retrieve money or verify a real identity.
What not to conclude
- Not every QR scan installs malware. The FTC describes phishing and malware as possible outcomes; it does not say every scan does either.
- A scanned page that looked real is not proof it was real. Check the claimed event inside the service’s own app.
- A package with no matching order does not identify the sender. Do not treat a name or return address on the label as verified.
- Rules for unsolicited goods differ by country. This article does not extend any national rule to other markets.
- Changing a password is not a guarantee of recovery. It reduces exposure; whether an account or payment is restored depends on the provider.
A short worksheet you can copy
Fill this in before you act, so you do not have to reconstruct it later:
- State: A / B / C
- Date and time of scan (if any):
- What the page or prompt claimed to be (carrier, retailer, bank, other):
- What it asked for (password / one-time code / card number / fee / app install):
- What you entered, if anything:
- Accounts affected:
- Password changed: yes / no — from official app or site: yes / no
- Two-factor enabled: yes / no
- Recovery method still accessible: yes / no
- Card issuer contacted (if card details entered): yes / no
- Reported to (local authority, carrier, retailer):
When you are done, the useful next action is to confirm each affected account from its own app: password changed, two-factor on, recovery method working, and no unrecognized sessions or connected apps.