What is happening here
A fake parcel notice claims a delivery could not be completed and asks you to scan a QR code to reschedule, pay a redelivery fee, or confirm your address. Couriers do leave cards, but they do not usually demand payment through a QR code on a door tag.
These notices arrive as door tags, slips in the letterbox, texts, or emails. They borrow the look of a courier brand and lean on the fact that many people are genuinely waiting for a parcel.
Red flags to check before you scan
- The notice gives no tracking number you recognise, or the number does not match anything you ordered.
- It asks for a small redelivery fee, customs charge, or address confirmation before releasing the parcel.
- The wording is vague about which courier, which parcel, and which address.
- The QR code is the only way to act. There is no depot address, phone number, or app you can check.
- The notice arrived when you are not expecting any delivery, or it names an item you never ordered.
Verify before you trust it
1. Check the tracking number in the courier official app or site by typing the address yourself.
2. Look at your order history and messages from the retailer to see whether a delivery is actually on its way.
3. If a card was left at your door, check whether it matches the style of cards that courier normally leaves.
4. Do not scan the code to see where it goes. Verify the delivery through a channel you already trust.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR scan log](/qr-scan-log) before you trust a code you did not expect.
- Inspect the code with the [QR typosquat checker](/qr-typosquat-checker) before you trust a code you did not expect.
- Check the address with the [QR tamper evidence planner](/qr-tamper-evidence-planner) before you trust a code you did not expect.
- Practise spotting patterns with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Review the chain with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Keep a record with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Plan protection with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
