The mystery package with a QR code

A package arrives that you never ordered — often with no sender's name. Inside there may be a cheap trinket, or nothing but a card with a QR code: "scan to see who sent this" or "scan to return."

Curiosity is the whole trick. The code opens a page that asks for card details or logins, or quietly installs data-stealing software on your phone. The parcel itself is the bait — police and consumer authorities have warned about exactly this scheme since 2025.

What to do: you never owe anyone a scan. A real gift needs no login and no card number. Keep or bin the item, don't scan the code — and check your shopping accounts (from the app, not from any link) in case someone else is using your address.