Lake Charles, Louisiana - As holiday packages arrive on doorsteps across Louisiana, residents are being warned about a growing threat hidden in some of those deliveries: QR code gift scams that can steal personal and financial information or install malware on phones.

The scheme, often called a “brushing scam,” involves sending unexpected packages to people who never ordered them. Inside, the box may contain a small gift such as costume jewelry or a low-cost electronic gadget. The real danger, however, is not the cheap item. It is the QR code included with it.

These scams use a technique known as “quishing,” a form of phishing that relies on QR codes to lure victims to fake websites.

How the Holiday QR Code Scam Works

The scam typically unfolds in several steps:

1. Unsolicited Package Arrives
A resident receives a small, surprise package at home. The item may be:

• Inexpensive jewelry
• A phone accessory or small electronic device
• A trinket or novelty gift

The recipient usually has no memory of ordering it, and the sender may be unclear or generic.

2. Curiosity Hook With a QR Code
Inside the box, there is often a note encouraging the recipient to scan a QR code. The message may say something like:

• “Scan to see who sent this gift”
• “Scan to claim your reward or bonus gift”
• “Scan for shipping confirmation or delivery details”

This plays on curiosity and the natural urge to figure out why the package arrived.

3. Malicious Redirect Through “Quishing”
When the QR code is scanned with a smartphone camera, it takes the user to a website that appears legitimate. It may look like:

• A major retailer’s return or tracking page
• A familiar online marketplace
• A gift claim portal or loyalty rewards page

This is the core of “quishing” — QR code phishing — where the code redirects the user to a fake site designed to trick them.

4. Data Theft Through Fake Forms
Once on the fake site, the user may be asked to:

• Log in with an email address and password
• Enter credit or debit card information
• Provide a Social Security number
• Share full name, address, or date of birth

Any information entered can be captured and used for:

• Fraudulent purchases
• Bank account access
• Opening new credit accounts
• Full-scale identity theft

5. Hidden Malware on the Device
In some cases, scanning the QR code or clicking links on the fake site may trigger a download. This download can be malware — harmful software that:

• Steals passwords saved in a browser
• Monitors activity on the device
• Gives remote access to the phone or tablet
• Sends data quietly to criminals in the background

This kind of access can allow criminals to move from one account to many, even if the user never directly types sensitive information on the fake website.

The Real Risk: Where the QR Code Leads

Security experts emphasize that the QR code itself is not inherently dangerous. The risk comes from where the code sends the user.

Unlike a normal web link that is visible on screen, QR codes hide the URL behind a black-and-white pattern. That makes it easier for criminals to disguise malicious links, because people often scan first and think later.

The scam relies on three main factors:

• Surprise: An unexpected gift lowers suspicion.
• Curiosity: People want to know who sent the item.
• Convenience: Scanning a code is quick and easy, especially during the busy holiday season.

By combining these elements, scammers can trick residents into visiting fake websites and handing over their own information.

What Residents Should Do If They Receive an Unsolicited Package With a QR Code

Authorities and consumer protection agencies recommend several simple steps to stay safe:

Do Not Scan the QR Code
The safest and most effective defense is to avoid scanning any QR code that comes in an unsolicited package. If a person did not order the item and does not recognize the sender, the code should be treated as suspicious.

It Is Safe to Keep the Item Itself
The physical gift is often just a prop in the scam. Receiving a low-cost item in the mail is not, by itself, a sign of theft from the recipient. The problem is the attempt to trick the recipient into scanning the QR code and giving away information.

Residents may:

• Keep the item if they want it, and throw away the QR code
• Discard both the item and any included materials, including codes and notes

Dispose of the QR Code Safely
If the package is thrown away, the QR code and any printed material with it should be destroyed or discarded in a way that prevents casual scanning by others in the household.

Steps to Take If the QR Code Has Already Been Scanned

If someone has already scanned the code or entered information on a linked website, experts recommend taking action quickly:

1. Change Passwords on Important Accounts
Update passwords for:

• Email accounts
• Online banking and credit card accounts
• Shopping, payment, and financial apps

Using strong, unique passwords and a password manager can reduce future risk.

2. Turn On Two-Factor Authentication (2FA)
Two-factor authentication adds an extra step when logging in, such as a code sent by text or generated by an app. This can help protect accounts even if passwords are stolen.

3. Check Financial Accounts and Credit Reports
Monitor bank statements and credit card activity for:

• Unrecognized charges
• New accounts or loans
• Unusual withdrawals

Checking credit reports regularly can help catch early signs of identity theft.

4. Report Suspected Identity Theft to the FTC
If personal identifying information has been entered on a suspicious site, or if fraudulent activity appears, residents are advised to report identity theft to the Federal Trade Commission (FTC). The FTC provides step-by-step recovery guidance and documentation that can be used with banks and credit bureaus.

Why This Scam Spreads During the Holidays

The holiday season gives scammers several advantages:

• Higher Package Volume: People are more likely to accept unexpected deliveries without question.
• More Online Shopping: Residents are used to receiving boxes from multiple retailers, sometimes forgetting what they ordered.
• Busy Schedules: People may not take time to verify details or question an odd package.

This environment makes it easier for criminals to slip fraudulent items into the mix and rely on QR codes to do the rest of the work.

How Residents Can Protect Themselves Year-Round

While the warning is especially timely during the holidays, experts say these habits are useful at any time of year:

• Be skeptical of unexpected packages, especially those with QR codes asking for personal information.
• Avoid scanning QR codes from unknown sources, whether on flyers, cards, or unsolicited packages.
• Never enter bank information, Social Security numbers, or login credentials on a site reached through an untrusted QR code.
• Go directly to official websites by typing the address into a browser rather than following links or codes from suspicious messages or packages.

Staying alert to these tactics can help residents keep their personal and financial information secure and reduce the risk of identity theft.