A new package scam began this summer, and it’s likely to gain momentum as people start ordering their iPhone Airs and buying gifts for the holidays.
I’ve discussed package scams before, especially “brush” or handing out products with fake reviews, but this version is much more dangerous to the unsuspecting receiver. Here’s how it works and what to do if you think you’ve been targeted.
Read more : 4 common package scams to watch out for
Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.
QR code scam and how it works
Picture getting a package delivered to your front door. You’re probably vaguely expecting something or not even sure why it’s there. The label doesn’t have any obvious information, making it hard to tell what it is. What it does have is a prominent QR code with instructions to scan it to find out more.
That would be a big mistake. These codes can easily take you to any URL with a quick tap, and are a dangerous entry point for all kinds of cybercrime. This could lead to automatic downloads of malware aimed at stealing sensitive personal data, or malware that locks your phone, followed by threats and extortion.
Or even more nefarious, the QR code could link to a normal-looking website that asks you to enter your account information—like, say, your Amazon login—so you can learn more about the package and who sent it. This page is designed to steal your login information for online identity theft, but it’s not always easy to remember in the moment.
Read more : Promptware threatens to take over AI and smart homes: Here’s how to protect yourself
What to do if you receive a mysterious package without sender information
If you receive a mysterious package with no sender information, don’t scan the QR code to find out more or open it. Instead, look for any type of tracking number or package ID number with the carrier that delivered it. If you were expecting a package, contact your seller to see if they’ve updated the package status to delivered or if they’ve given you a tracking number to follow.
If you don’t recognize the package at all, you can try contacting the carrier and reporting the wrong item. In a scam, someone already has your address, so this may not work, but there are ways to start removing your home address from the internet. If the package identifies a seller, such as Amazon, visit your account and change your email and password login.
The items you deliver yourself are probably not dangerous, and in a cleanup scam, it’s usually harmless junk that you can throw away if the carrier refuses to take the package back.
What if you’re already scanning a QR code?
If you’re already scanning a QR code, change the account logins and passwords you use to send it or that you may have entered on the QR code website. If the code downloaded something to your phone, immediately switch to airplane mode or turn off Wi-Fi. If your phone allows you to go into safe mode, try to find out what was downloaded and remove it.
If you’re still having problems, factory reset your phone completely from the settings screen. You should also change the passwords on all accounts associated with your phone. Finally, consider ordering a free credit report from one of the major credit bureaus: Equifax, Experian, or TransUnion.
To learn more, check out my guide to smart home devices to prevent package theft, how package delivery boxes are making a big comeback, and how to stop porch pirates in general.
