Amazon QR Code Scam (2026): Don't Scan That Package

Short answer: An Amazon QR code scam is usually an unordered Amazon-looking box with a QR card — “who sent this gift,” “claim a reward,” or “confirm delivery.” Do not scan. Open the real Amazon app, check Orders, and report through Amazon — never through the card. The same rule covers the amazon package scam pattern people report when no order exists.

Do this now (under two minutes)

1. Do not scan the QR code on the package, sticker, or insert card.
2. Open Amazon yourself — app icon or typed amazon.com, not a link from the box.
3. Check Orders (and ask anyone else in the house).
4. No match? Report an unordered / suspicious package through Amazon’s official help, then destroy or discard the QR card.
5. Already scanned? Jump to If you already scanned — passwords and cards first, curiosity later.

That sequence beats every “gift” story printed on cardboard.

Real vs fake at a glance

Your address being correct does not prove Amazon sent it. Brushing and bait drops use real street data on purpose.

What an Amazon QR code scam looks like

Police alerts, the FBI’s unsolicited-package warning, and consumer reports describe the same shape:

1. Unexpected delivery — brown box, familiar marketplace look, your name/address right.
2. Thin product or only a card — cheap item, or nothing but a glossy insert.
3. Curiosity line — scan to see who sent the gift, leave five stars for a reward, “verify” delivery, unlock credit.
4. Hidden link — the QR encodes a URL you cannot safely trust until after you aim a camera at it.
5. Capture — fake Amazon/bank login, small payment, personal-data form, or app install.

Related costumes (same engine, different wrapper):

• Amazon-looking postcards with a QR “offer”
• Delivery texts/emails with QR codes or shortened links
• Public QR stickers overlaid on real codes (parking, menus) — different place, same “link you cannot read” risk

Why the box exists (brushing + quishing)

Two tricks stacked:

• Brushing — unordered items shipped so someone can fake “verified” reviews or muddle your porch.
• Quishing (QR phishing) — the code hides a malicious destination better than a printed URL.

The FBI has warned that unsolicited packages with QR codes can steal personal/financial data or push malware. Branding on the cardboard is costume. The destination after the scan is the crime.

Card wording patterns (save these)

Scam inserts often sound polite and urgent at once:

• “Scan to see who sent this gift”
• “Leave a 5-star review — unlock a reward”
• “Confirm delivery details”
• “Claim your Amazon credit”
• “Thank your secret sender”

Friendly language is not safety. It is bait.

Household ritual (one sentence)

If a package you did not order asks you to scan a QR code, put the phone down and open the shopping app instead.

Say it to parents, roommates, and kids. Rituals beat hallway panic.

Quick checks before anyone touches the code

• Does Orders show this shipment?
• Would Amazon need a paper QR to manage a real order? (No.)
• Does camera URL preview show a weird domain, shortener, or lookalike (arnazon, amaz0n, random .xyz)?
• Is the card’s only job to push a scan?

If Orders is empty and the card exists only to get scanned, you are done. Report, discard the card, keep your passwords.

If you already scanned

Scanned only — typed nothing
Close the page. Do not reopen the link. Watch for odd account prompts.

Entered Amazon login
Change the password in the official app/site. Review devices / sign out other sessions. Confirm two-factor authentication. Change reused passwords elsewhere.

Entered a card or paid a “fee”
Call the number on the back of your card. Ask for fraud monitoring or a replacement. Watch for small test charges.

Installed an app / profile
Remove unknown installs. Run Play Protect (Android) or review profiles/apps (iOS). Seek a deeper cleanup if the phone acts wrong (pop-ups, new admin apps, battery drain).

Then report: Amazon’s official unordered-package / scam flows, ReportFraud.ftc.gov, and local police if needed.

Common mistakes that keep this scam alive

• Scanning “just for a second” in the doorway
• Trusting Amazon-looking packaging over order history
• Logging in “to see the gift details”
• Installing whatever the QR page suggests
• Calling a support number printed on the scam card
• Assuming “correct address = Amazon sent it”
• Letting guests or kids scan because the box looks fun

Move the check into the official app and the scam usually collapses.

Trusted sources

• FBI: unsolicited packages containing QR codes
• USPIS: brushing scam
• Amazon Help: unordered or unexpected packages
• Report fraud to the FTC
• CISA: phishing guidance

Key takeaways

• The Amazon QR code scam uses a real-looking unordered box to hide a phishing or malware link.
• People also find this page for amazon package scam — same rule: Orders first, scan never.
• Curiosity lines (“who sent this?” / “claim reward”) are the social engineering.
• Official Orders beat cardboard every time — scan never, app first.
• If you already scanned, close the loop on passwords, cards, and installs fast.
• Teach one household rule: mystery package QR → official Amazon app, not the camera shutter.