A New QR Code Scheme Targeting Victims
In the fast-paced world of online shopping, receiving packages is a common occurrence. However, scammers have found a way to exploit this convenience by tricking unsuspecting recipients into scanning malicious QR codes. At Citynet, we want to keep you informed and protected from cyber threats, including this new scheme known as the “Unsolicited Package Scam.”
How the Scam Works
- The Unsolicited Package
You receive a package at your doorstep that you don’t recall ordering. It often contains a low-value item, such as a small trinket, phone case, or other generic goods. These packages are designed to appear legitimate, with professional-looking shipping labels and return addresses. - The QR Code Trap
Inside the package, you’ll find a note claiming there’s been an error, or the sender requests that you confirm the delivery. This note often includes a QR code, accompanied by a message urging you to scan it for more information or to process a refund. - The Cyber Attack
When you scan the QR code, it directs you to a fake website that may:- Ask for personal information, such as your name, address, phone number, or even payment details.
- Infect your device with malware designed to steal sensitive data.
- Prompt you to install apps that compromise your device’s security.
Why This Scam Is Effective
Scammers rely on psychology and urgency to make their schemes work. Receiving an unexpected package creates curiosity, and the promise of resolving a supposed issue with a quick QR code scan feels like the easiest solution. Most people don’t think twice before scanning a QR code, which is exactly what the scammers count on.
How to Protect Yourself
- Verify Before Scanning
If you receive an unexpected package with a QR code, do not scan it. Double-check with the delivery company or retailer to see if the shipment is legitimate. - Inspect the Package
Look for signs of tampering or inconsistencies in the shipping label. Generic sender names, unknown companies, or poor packaging could be red flags. - Avoid Providing Information
Legitimate delivery companies will not ask you to confirm details through a QR code. Never input personal or financial details into a website you’ve accessed from a QR code. - Use a QR Code Scanner with Security Features
Some apps allow you to scan QR codes while previewing the link destination before opening it. This can help identify malicious sites. - Report Suspicious Activity
If you suspect the package or QR code is part of a scam, report it to local authorities, the Federal Trade Commission (FTC), and the delivery service.
Stay Vigilant
The convenience of technology comes with its risks, but by staying informed and cautious, you can avoid falling victim to scams like the unsolicited package scheme. Share this information with family, friends, and coworkers to help them stay safe, too.
