Cybersecurity

Beware of the “Unsolicited Package Scam”

December 18, 2024

A New QR Code Scheme Targeting Victims

In the fast-paced world of online shopping, receiving packages is a common occurrence. However, scammers have found a way to exploit this convenience by tricking unsuspecting recipients into scanning malicious QR codes. At Citynet, we want to keep you informed and protected from cyber threats, including this new scheme known as the “Unsolicited Package Scam.”

How the Scam Works

The Unsolicited Package
You receive a package at your doorstep that you don’t recall ordering. It often contains a low-value item, such as a small trinket, phone case, or other generic goods. These packages are designed to appear legitimate, with professional-looking shipping labels and return addresses.
The QR Code Trap
Inside the package, you’ll find a note claiming there’s been an error, or the sender requests that you confirm the delivery. This note often includes a QR code, accompanied by a message urging you to scan it for more information or to process a refund.
The Cyber Attack
When you scan the QR code, it directs you to a fake website that may:
1. Ask for personal information, such as your name, address, phone number, or even payment details.
2. Infect your device with malware designed to steal sensitive data.
3. Prompt you to install apps that compromise your device’s security.

Why This Scam Is Effective

Scammers rely on psychology and urgency to make their schemes work. Receiving an unexpected package creates curiosity, and the promise of resolving a supposed issue with a quick QR code scan feels like the easiest solution. Most people don’t think twice before scanning a QR code, which is exactly what the scammers count on.

How to Protect Yourself

Verify Before Scanning
If you receive an unexpected package with a QR code, do not scan it. Double-check with the delivery company or retailer to see if the shipment is legitimate.
Inspect the Package
Look for signs of tampering or inconsistencies in the shipping label. Generic sender names, unknown companies, or poor packaging could be red flags.
Avoid Providing Information
Legitimate delivery companies will not ask you to confirm details through a QR code. Never input personal or financial details into a website you’ve accessed from a QR code.
Use a QR Code Scanner with Security Features
Some apps allow you to scan QR codes while previewing the link destination before opening it. This can help identify malicious sites.
Report Suspicious Activity
If you suspect the package or QR code is part of a scam, report it to local authorities, the Federal Trade Commission (FTC), and the delivery service.

Stay Vigilant

The convenience of technology comes with its risks, but by staying informed and cautious, you can avoid falling victim to scams like the unsolicited package scheme. Share this information with family, friends, and coworkers to help them stay safe, too.

Like This Post?

Cybersecurity

You’ve Been Served… a Scam!

Beware of Fake Toll Violation Text Messages Cybercriminals are constantly evolving their tactics to trick people into giving up sensitive information. One of the latest scams circulating involves fake toll violation notices sent by text message. At first glance, the message looks convincing. It claims you have an unpaid traffic toll that must be paid immediately. The text often includes

March 11, 2026

Cybersecurity

Cybercriminals Are Now Calling Your Employees

Is Your Business Prepared? Cyber threats are evolving, and one of the fastest-growing tactics right now is social engineering through trusted communication platforms. Instead of trying to hack their way in, cybercriminals are increasingly talking their way in. Attackers are impersonating IT staff, executives, vendors, and even coworkers via phone calls and collaboration tools such as Microsoft Teams, Webex, and other messaging

March 5, 2026

Cybersecurity

Shadow IT: The Apps Your Employees Use That IT Doesn’t Know About

When most businesses think about cybersecurity risk, they picture hackers breaking in from the outside. But one of the fastest-growing risks isn’t external at all. It’s happening inside your organization…quietly, unintentionally, and often with good intentions. It’s called Shadow IT. And it’s growing faster than most businesses realize. What Is Shadow IT? Shadow IT refers to any software, app, cloud platform,

February 23, 2026

Cybersecurity

The New Employee Is Your Biggest Security Risk

(And It’s Not Their Fault) When businesses think about cybersecurity risk, they often picture hackers, ransomware, or sophisticated phishing attacks. But one of the most common — and overlooked — security risks starts on day one: A new employee. Not because they’re careless.Not because they’re malicious.But because onboarding and offboarding processes often leave dangerous gaps. If those gaps aren’t managed

February 23, 2026

Cybersecurity

The New Reality of Cyber Insurance Requirements for Small Businesses

Cyber insurance used to feel like a safety net. Today, it’s starting to feel more like an application for a mortgage. Across the country, insurance providers are tightening requirements, raising premiums, and even denying claims when businesses don’t meet modern cybersecurity standards. Many small and mid-sized organizations are discovering this shift the hard way, during policy renewal or after filing

February 19, 2026

Cybersecurity

Citynet and Red Siege Webinar Inside the Attacker’s Playbook

Cybersecurity isn’t just about defense — it’s about understanding how real attackers think. Join Citynet’s Craig Behr and Red Siege’s Tim Medin for an upcoming webinar, Inside the Attacker’s Playbook, where we’ll break down how real-world offensive operations uncover gaps — and how organizations can use those insights to reduce cyber risk before it becomes a business problem. Play Video

February 5, 2026