The Mystery Amazon Package With a QR Code

A friend asked me about this one just last night. A package showed up on her porch with the Amazon smile on the box and her name and address on the label. She hadn’t ordered anything. Inside was a little note with a QR code: “Scan to find out who sent you this gift.”

Then another one came. Then another.

That’s not a secret admirer. That’s a fishing line, and the QR code is the hook.

Think of it like a present with a strange gift tag

Imagine finding a wrapped present on your porch. The tag says: “To find out who this is from, just write down the code to your front door lock and leave it under the mat.”

You’d never do that. No real gift giver needs your door code. But that’s exactly what this package is asking for. Your Amazon password is the code to your front door, and the “who sent this?” note is the tag that asks you to leave it under the mat.

How the trick works, step by step

1. A package arrives with your correct name and address and Amazon branding on the outside. Sometimes there’s a cheap item inside, sometimes just the note.
2. The note gives you a reason to scan. “Find out who sent this gift.” “Confirm your delivery details.” “Claim your reward for leaving a review.”
3. The QR code opens a fake Amazon page on your phone. It looks right: the logo, the colors, the sign in box.
4. It asks you to “verify” your account by signing in. Sometimes it asks you to download an app instead.
5. Whatever you type goes straight to the scammer. They sign in to your real account, shop with your saved cards, and try that same password on your email and your bank.

Why it feels so believable

It knows your real name and address. That part is real, and it’s unsettling. But it doesn’t mean anyone hacked you. Names and addresses leak in data breaches all the time and get sold in big lists. It’s the same reason people get mystery brushing packages. This is that scam with a nasty new twist.

It showed up in real life. We’ve all learned to be suspicious of weird emails. A physical box on your porch skips right past that alarm, because it feels like something a real company sent. Anyone can buy boxes and packing tape with a smile printed on it, though. The box is a costume.

You can’t read a QR code. A link in an email at least shows you a web address. A QR code is a link wearing a disguise. You don’t know where it goes until you’re already there. (Same trick as the fake parking meter QR codes.)

Curiosity does the rest. Who sent me this? Everybody wants to know. The scam is betting on it.

What to do if one shows up at your door

• Don’t scan the code. Not even just to look.
• Check Amazon the long way. Open the Amazon app you already have, or type amazon.com yourself, and look at Your Orders. If it isn’t there, it didn’t come from your account. If it is there and you didn’t order it, someone may already have your password, so change it right away.
• Keep the item or toss it. In the U.S., you’re allowed to keep merchandise you never ordered, and you don’t owe anyone for it. Just throw out the note with the code.
• Report it to Amazon at amazon.com/reportascam (typed in yourself, of course).
• Turn on two step verification for your Amazon account in Login & Security. Then a stolen password alone isn’t enough to get in.

If you already scanned it and signed in

First, take a breath. This one is designed to fool careful people, and moving quickly matters more than feeling bad about it.

• Change your Amazon password from the app or by typing amazon.com yourself. Never from a link.
• Change it anywhere else you used that same password, starting with your email. Your email is the master key that resets everything else.
• Look around your Amazon account: Your Orders, saved payment methods, delivery addresses, and gift card balance. Delete anything you don’t recognize.
• Call your bank or card company using the number on the back of your card, and ask them to watch for charges you didn’t make.
• If it had you download an app, delete it, and have someone you trust look over your phone.