How the Scam Works
The scam operates by sending unsuspecting victims a package containing a “free gift.” The package may appear to be from a familiar retailer and includes the recipient’s full name and address, making it seem legitimate. However, the real danger lies inside the package—a QR code that, once scanned, grants cybercriminals access to sensitive data stored on the victim’s phone.
Bo Braxton Da Savage, a police officer who goes by @fitbocop1914 on social media, recently shared a warning about the scam, admitting that even he might have fallen for it if he hadn’t been informed. In a video posted on Instagram, he explained, “So what’s going to happen is, you get the package, you’re going to look at it and think, ‘Aw okay, someone sent you a gift.’ There’s going to be a QR code on the package or in the package.”
He continued, “[…] And you’re going to scan the QR code and once you scan the QR code every bit of information in your phone is going to get sent to the scammer – it’s going to send your credit card information, your bank information, your pictures, your phone numbers, your contacts. Everything that’s in your phone, after you scan that QR code, is going to get sent to the scammer.”
Cybersecurity Experts Echo Warnings
This is not the first time experts have warned about the risks of scanning unverified QR codes. Cybersecurity specialist Adrianus Warmenhoven from NordVPN explained that hackers can exploit vulnerabilities in smartphone browsers. If a QR code leads to a malicious site, an attacker can take over the device, often without the victim realizing it.“If you have an unpatched browser or one with a vulnerability, and the QR code takes you to your phone’s browser, then an attacker can take over and infect the system on your device,” Warmenhoven warned.
How to Stay Safe
Authorities strongly advise people to be skeptical of unsolicited packages, especially those containing QR codes. If you receive an unexpected package, simply keep the gift or dispose of it—but never scan the QR code in an attempt to identify the sender.Experts suggest treating QR codes with the same caution as unknown links. Always verify the source before scanning, and ensure your device’s security software is up to date to minimize risks.
As cybercriminals continue to develop more sophisticated scams, staying informed and cautious is crucial to protecting personal and financial data.
