Got an unexpected package? Should you be worried?

QR codes are practically everywhere. We use them to view menus, pay bills, download apps…you get the point. QR codes have become a integral part of our day-to-day lives. They’re fast, they’re easy, and they’re harmless. Right?

Unfortunately, scammers are taking advantage of that ease and familiarity.

A scam that is growing in popularity has to do with packages. Some people are receiving unexpected packages or small gifts in the mail with a paper note inside. This note typically has some form of message that mentions scanning a QR code to see who the gift was from or if you believe you received the gift by mistake and is made to look like it has come from a legitimate merchant. There are many variations of this message, but the goal here is to provide a valid reason to get you to scan the QR code without thinking. Once you scan the QR code, scammers can gain access to important personal information and credentials on your phone.

This isn’t to say that your grandmother couldn’t have sent you a very legitimate gift and just forgot to tell you about it, but it is important to remember that anything received unexpectedly should be treated with caution. So, what should you do if you receive an unexpected item in the mail?

The first thing you should do is make sure that the package is actually addressed to you. Mail, and packages, get misdelivered all the time. Check the name and address to verify it is for you. If it’s not, try to get the package where it should be by calling the delivery service and reporting a misdelivery. Next, check your account with the merchant through a verified channel, like their website or app, to make sure something wasn’t purchased accidentally or a scheduled re-order didn’t happen that you forgot about. You should also check your bank or credit card transactions to make sure your card wasn’t charged wrongfully. Reach out to them through their verified contact methods if anything looks incorrect. Ultimately, if all of that looks ok, reach out to family and friends to see if maybe they decided to surprise you with something!

If everything appears to be normal, it is a good idea to change your passwords for your online shopping accounts and check your credit report over the next few weeks for signs of identity theft. It’s also a good idea to report the potential scam to the Federal Trade Commission.

And what do you do with the package? Keep it…if you want. It is ultimately a gift. The true scam here takes place once you scan the QR code.

Remember, always take caution when you receive something unexpectedly, never scan a QR code from an unknown source, and never provide personal or login information.