Cybersecurity

Beware of the “Unsolicited Package Scam”

December 18, 2024

A New QR Code Scheme Targeting Victims

In the fast-paced world of online shopping, receiving packages is a common occurrence. However, scammers have found a way to exploit this convenience by tricking unsuspecting recipients into scanning malicious QR codes. At Citynet, we want to keep you informed and protected from cyber threats, including this new scheme known as the “Unsolicited Package Scam.”

How the Scam Works

The Unsolicited Package
You receive a package at your doorstep that you don’t recall ordering. It often contains a low-value item, such as a small trinket, phone case, or other generic goods. These packages are designed to appear legitimate, with professional-looking shipping labels and return addresses.
The QR Code Trap
Inside the package, you’ll find a note claiming there’s been an error, or the sender requests that you confirm the delivery. This note often includes a QR code, accompanied by a message urging you to scan it for more information or to process a refund.
The Cyber Attack
When you scan the QR code, it directs you to a fake website that may:
1. Ask for personal information, such as your name, address, phone number, or even payment details.
2. Infect your device with malware designed to steal sensitive data.
3. Prompt you to install apps that compromise your device’s security.

Why This Scam Is Effective

Scammers rely on psychology and urgency to make their schemes work. Receiving an unexpected package creates curiosity, and the promise of resolving a supposed issue with a quick QR code scan feels like the easiest solution. Most people don’t think twice before scanning a QR code, which is exactly what the scammers count on.

How to Protect Yourself

Verify Before Scanning
If you receive an unexpected package with a QR code, do not scan it. Double-check with the delivery company or retailer to see if the shipment is legitimate.
Inspect the Package
Look for signs of tampering or inconsistencies in the shipping label. Generic sender names, unknown companies, or poor packaging could be red flags.
Avoid Providing Information
Legitimate delivery companies will not ask you to confirm details through a QR code. Never input personal or financial details into a website you’ve accessed from a QR code.
Use a QR Code Scanner with Security Features
Some apps allow you to scan QR codes while previewing the link destination before opening it. This can help identify malicious sites.
Report Suspicious Activity
If you suspect the package or QR code is part of a scam, report it to local authorities, the Federal Trade Commission (FTC), and the delivery service.

Stay Vigilant

The convenience of technology comes with its risks, but by staying informed and cautious, you can avoid falling victim to scams like the unsolicited package scheme. Share this information with family, friends, and coworkers to help them stay safe, too.

Like This Post?

The Latest Scams

Scammers Are Targeting Home Projects—Here’s What to Watch

If you’re building, renovating, or improving your home, there’s a new scam you need to watch for—and it’s catching people at exactly the wrong time. How the Scam Works You receive an email that appears to come from a local government office—maybe your city, county, or permitting department. The message claims there’s an issue with your project and that you

March 30, 2026

Fiber

Stop the Buffer: How to Get the Most from Your Streaming Experience

There’s nothing more frustrating than getting to the final seconds of a close game—only to see the spinning buffering wheel right before the winning shot. While buffering is often blamed on slow internet, that’s not always the case—especially if you’re already connected to Citynet Fiber. Your streaming device, settings, and even your home network setup can all impact performance. Here’s

March 27, 2026

Technology

Phone Photography Tips: Take Better Photos This Spring

Capture Spring Like a Pro — With Just Your Phone Spring is one of the most photogenic times of year—blooming flowers, longer golden-hour light, and weekends filled with moments worth remembering. The best part?You don’t need a $3,000 camera or professional training to capture it all. The phone in your pocket is more powerful than most people realize. With just

March 27, 2026

Cybersecurity

How Long Attackers Stay in a Network Before They’re Discovered

When people imagine a cyberattack, they often picture a dramatic event — systems suddenly shutting down or files becoming encrypted. But many cyber incidents don’t unfold that way. In many cases, attackers quietly gain access to a network and remain there for weeks or even months before being discovered. This period is known as “dwell time.” During this time, attackers

March 25, 2026

Cybersecurity

5 Critical Mistakes to Avoid During a Cyberattack

Think your business may already be compromised? See the warning signs and response steps here Even well-intentioned actions can make a cyber incident worse Cyberattacks often unfold quickly, and the wrong response in the first few minutes can make an incident far more difficult to contain and investigate. When a cyber incident occurs, the natural reaction is to act quickly

March 25, 2026

Cybersecurity

How Most Cyberattacks Actually Start

It’s usually not a sophisticated hack — it’s a moment of trust. Many organizations imagine cyberattacks as highly technical breaches targeting servers or networks. In reality, most cyber incidents begin with something much simpler – a human mistake or a moment of misplaced trust. Cybercriminals increasingly focus on manipulating employees rather than breaking through technical defenses. Here are some of

March 25, 2026