The Weighted Package QR Code Trick

You expect a package. You see a notice on your door. It looks official, with a QR code promising easy tracking or redelivery. But scanning that code could hand cybercriminals direct access to your bank accounts, credit cards, and personal identity. This new variant of the missed package scam is gaining traction across the United States, and it is designed to exploit your trust in everyday delivery services.

The scam works in a simple, convincing way. Fraudsters print fake delivery notification slips that mimic the look of USPS, FedEx, or UPS missed delivery cards. They place these slips on your front door, often weighted with a small piece of cardboard or plastic so they do not blow away. The slip tells you your package was attempted but could not be delivered because of an incorrect address or a small unpaid fee. It then directs you to scan a QR code to resolve the issue, schedule a new delivery, or pay a minimal charge, typically between one and three dollars. That low amount is intentional. It feels insignificant, not worth a second thought.

But when you scan that QR code, your phone opens a link to a fake website that looks nearly identical to the real delivery company’s portal. The site asks you to enter your name, address, phone number, and email. Then it prompts you to enter your credit card number to cover the small fee. Once you submit that information, two bad things happen simultaneously. First, the scammers immediately charge your card for a much larger amount, often several hundred dollars, or they sell your card number on the dark web. Second, they now have enough personal data to impersonate you in broader identity theft schemes, opening new credit accounts or filing fraudulent tax returns under your name.

What makes this trick particularly dangerous for people aged 45 to 64 is that it preys on a very real experience. Many of you order items online for your home, for gifts, or for work. You are accustomed to packages arriving frequently. When you receive a missed delivery notice, your first instinct is not suspicion but action. You want to resolve the problem quickly, especially if you are expecting something time sensitive. The weighted package slip feels physically real, unlike an email or text message that can be easily deleted. Because it is physically on your property, your brain assigns it a higher level of legitimacy.

Scammers know this. They invest in high-quality printing and paper stock to make the slip look authentic. The slip will often include logos stolen from delivery companies, official-looking barcodes, and even fake tracking numbers. The slip may also mention a specific company name you recognize, like Amazon or Walmart, to further lower your guard. They may say the package is from a friend or family member, triggering an emotional response. The weighted element, whether a small piece of cardboard or a metal clip, is a psychological trick too. If the slip feels substantial in your hand, it feels more official.

To protect yourself, you must develop a simple two step mental check. First, never scan a QR code from any unsolicited delivery notice that appears on your property. Legitimate delivery companies do not use QR codes on door tags to collect payments or personal information. The real USPS, FedEx, and UPS will leave a paper slip with a tracking number that you can manually enter on their actual website, not a QR code. Second, if you receive such a slip, inspect it closely. Look for spelling errors, awkward phrasing, or a generic email address printed on the slip. Check the tracking number against your own records. If you are not expecting a package, the slip is almost certainly fraudulent.

If you suspect you have already scanned a fraudulent QR code, act immediately. Contact your bank or credit card issuer to freeze your card and dispute any charges. Place a fraud alert on your credit file with the three major credit bureaus, Equifax, Experian, and TransUnion. Change the passwords on your email, banking, and shopping accounts. Report the incident to the Federal Trade Commission at reportfraud.ftc.gov. You can also file a complaint with the USPS Inspection Service if the slip impersonated the Postal Service.

The weighted package QR code trick is a physical version of the phishing scams you may have read about in your email inbox. It uses the same principle of trust and urgency but adds a tangible object to bypass your digital skepticism. Remember that no legitimate delivery service will ever demand payment through a QR code on your front door. When you see a slip, stop, look at it with a critical eye, and verify the information through channels you control. A few extra seconds of caution can save you from weeks of financial headaches.