Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Do not scan an unexpected holiday package QR code or a delivery QR code in an unsolicited text. A QR code is only a transport mechanism; the scam is the website, download or information request that follows. Verify any delivery or return request through the carrier or retailer’s app, website or phone number that you open independently.

What “quishing” means

Quishing is QR-code phishing. Criminals use a QR image to move you from a physical card, email or text to a destination they control. The destination may imitate a bank, government agency, retailer or delivery company and ask for information or an action that the legitimate organization would not request through that message.

The FBI warns that unsolicited packages can contain QR codes intended to collect personal or financial information or trigger a malware download. USPIS describes quishing as an identity-fraud scam that uses QR codes. The code itself is not proof that a package, text or website is genuine.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why holiday package scams look believable

Holiday shipping creates a plausible reason for an unexpected message or parcel. FTC warnings describe fake missed-delivery and address-update notices that pressure recipients to act quickly. A parcel may contain a gift-like item and a card telling you to scan a code to identify the sender or arrange a return.

#1 Best Overall
Eyoyo EYH2 Handheld USB Wired 2D 1D Barcode Scanner for POS Mobile Payment
  • Continuous Usage All Day: The EY-H2 USB barcode scanner is designed to always be ready for the next scan, which significantly reduces downtime and repair costs; it shortens checkout lines, improves customer service, and boosts business productivity
  • Plug and Play: Eyoyo wired barcode scanner is connected via a USB cable, with no need to install any driver or software; It offers effortless connection and is compatible with Windows, Mac, Android, and Linux; Seamlessly works with Quickbook, Word, Excel, Novell, and all common software
  • Supports Multiple 1D/2D Barcodes: Eyoyo QR code scanner scan with most 1D 2D barcodes with ease; 1D Barcodes: EAN, UPC, Code 39, Code 93, Code 128, UCC/EAN 128, Codabar, Interleaved 2 of 5, ITF-6, ITF-14, ISBN, ISSN, MSI-Plessey, GS1 Databar, Code 11, Industrial 25, Matrix 2 of 5, etc. 2D Barcodes: QR, DataMatrix, PDF417, and so on
  • Supports Screen Scanning: The Eyoyo 2D scanner is capable of reading barcodes from smartphone screens, such as mobile coupons, digital wallets, and digital loyalty cards; Before scanning, simply turn your screen brightness to the maximum
  • Sturdy Anti-Shock and Durable Design: The Eyoyo 2D barcode scanner features an ergonomic design made of high-quality ABS, enabling it to withstand repeated drops from 5 ft/1.5 m high onto the concrete ground; The durable plastic material ensures a long service life

Assess these as separate warning signs:

  • you were not expecting the package or cannot match it to an order;
  • the QR image is the only route to sender information, tracking or a return;
  • the message threatens an immediate return, fee or delivery failure; and
  • the linked page asks for a password, payment details, a one-time code, an app installation or unusual phone permission.

FTC calls the fake-delivery text pattern a phishing scam. An unexpected parcel can be part of the same operation, even when the contents appear harmless.

How to judge a suspicious holiday QR prompt

Check Lower-risk pattern Stop-and-verify pattern
Source A delivery you can match to an order you placed. An unsolicited parcel, vague sender or order you cannot identify.
Channel The carrier or retailer’s app or a website you type or open yourself. A QR destination embedded in a text, email, card or package.
Request Ordinary tracking information that does not require sensitive credentials. A password, card or bank number, one-time code, app install or unusual permission.
Urgency A normal delivery update with time to verify it. Immediate-return threats, address deadlines or demands to pay now.
Recovery path Support reached from a prior statement, known app or independently found official site. A phone number, web address or reply contact supplied only by the suspicious message or package.

What to do instead of scanning

  1. Pause. Do not scan the code, reply, call the supplied number or follow the supplied link.
  2. Check your own records. Look at orders in the retailer account you normally use and at carrier notifications you already trust.
  3. Open a known-good channel. Type the retailer or carrier’s address yourself, use its official app, or call a number from a previous statement or the physical payment card.
  4. Ask whether any action is actually required. A legitimate delivery problem should still be verifiable through the organization’s normal support channels.
  5. Preserve the evidence. Photograph the label and card, save the original text or email, and record any destination address shown by the scanner without visiting it again.

Never use contact details printed in the suspicious message or package to verify that same message.

Rank #2
NetumScan Desktop Barcode Scanner, USB QR Code Reader
  • 【Omnidirectional Automatic Barcode scanner】NetumScan Barcode Scanner can easily capture bar codes 1D, 2D/QR on labels, paper, and mobile phone or computer displays,Sensitive and accurately and you can easily scan damaged barcode, distortion barcode, colorful barcode and reflective barcode, etc special barcode. Perfect for retail and other high-volume scanning applications.
  • 【Automatic Smart Sensing Scanning】Specially equipped induction trigger, the desktop barcode scanner support auto-sensing scanning, barcode recognition more intelligent. When you not use the barcode scanner for a while, it will be into a sleeping mode. When handsfree barcode scanner in sleeping mode, it will automatically be activated once the item moving, and read the barcode under the window to upload to your device.
  • 【Non-slip Base and Anti-shock Design】Our Handsfree Omnidirectional Barcode Scanner can be directly placed on the desk, the anti-slip base makes it more stable, Built-in anti-vibration system can avoid damage while falling from the height of 4.92 feet. IP54 technology protects the wireless barcode scanner from dust.
  • 【Improve Your Efficiency】Compared with handheld barcode scanner, our handsfree barcode scanner is more free of your hands, no need to pick up the scanner when scanning, whether it is cashier scanning goods, or customer scanning digital barcode from smart phone. It can improve work efficiency and save time. Also it is so easy to use, no need extra training necessary for new staff.
  • 【Plug and Play, Easy to Use】No need to install any software or app, Our desktop barcode scanner is Plug and play. Easily connected with your laptop, PC, POS by USB Cable. Ideal work for Windows XP/7/8/10, Mac OS, Linux.(Note:NOT compatible with Square/Clover/Shopify.)

What happens after a scan

Scanning alone does not establish what was compromised. Risk depends on what the resulting page requested and what you did next.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

You scanned but entered nothing

Close the page and do not download anything or grant permissions. Review the browser’s recent downloads and the phone’s installed apps. If anything unfamiliar appeared, remove it and check account sign-in activity from the service’s known website.

Rank #3
NetumScan USB 2D Barcode Scanner
  • Fast 1D & 2D Code Reading: Built with a CMOS sensor and 32-bit decoding chip, this QR code scanner reads common 1D and 2D codes including UPC, EAN, Code 39, Code 128, QR Code, PDF417, Data Matrix and Aztec from printed labels or screens
  • USB Wired Plug and Play: Connect the wired barcode scanner to a standard USB port and start scanning without drivers or batteries. It works as keyboard input with Windows, macOS, Linux, spreadsheets, POS and inventory systems
  • Three Scan Modes for Different Jobs: Use trigger mode for controlled scans, auto-sensing mode for hands-free desk work, or continuous mode for batch scanning. Choose the mode that fits your workflow to reduce accidental repeat scans
  • Built for Daily Work Areas: The ABS+TPU body and silicone protective cover help protect the handheld barcode scanner from scratches and drops up to 6.56 ft, suitable for warehouse shelves, retail counters, libraries and office inventory
  • Practical Setup Support: Some barcode types or settings may need to be enabled by scanning setup barcodes. Keep the guide available when changing modes, suffix settings, or special code types such as Interleaved 2 of 5 or MaxiCode

You entered a password or one-time code

From the real service website or app—not the QR page—change the password immediately to a unique one and enable two-factor authentication. Change the same password anywhere else you reused it. Review recent sign-ins, recovery-email changes and new devices, and sign out sessions you do not recognize.

You entered card or bank information

Call the bank or card issuer using the number on the card or a statement. Explain that the information was submitted to a phishing page, ask what protective measures are appropriate, and monitor transactions for unauthorized activity.

Rank #4
Tera Barcode Scanner with Battery Indicator: 2D Wireless, D5100 Orange
  • 【Battery Level Indicator and 2200mAh Capacity】Larger battery enables longer continuous usage and twice the stand-by time of others. With the unique battery indicator light showing the remaining battery level, no more Low Battery Anxiety.
  • 【Ergonomic Design】 The curved handle is extended and thickened, tailor-made for North America customers. Specially designed smooth and flat trigger for better grip. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1.
  • 【Anti-Shock Silicone】 The orange anti-shock silicone protective cover can avoid scratches and friction while falling from the height of 6.56 feet. IP54 technology protects the wireless barcode scanner from dust.
  • 【2.4 GHz Wireless plus USB 2.0 Wired Connection】 Plug and play with the USB receiver or the USB cable, no driver installation needed. Easy and quick to set up. Wireless transmission distance reaches up to 328 ft. in barrier free environment.
  • 【Digital and Printed 1D 2D QR Bar Code Symbologies】1D: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard25, Matrix 2D: QR, DataMatrix, Aztec, Hanxin, Micro PDF417. (Note: Not compatible with Square.)

You installed an app or granted phone permissions

Stop using the QR-linked page. Review installed apps and their permissions, remove anything you did not intentionally install, and check account and device activity for unfamiliar changes. If you cannot remove the software or the device behaves abnormally, use your organization’s or device maker’s established support process before entering more credentials.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recovery checklist

  • Close the QR-linked page and do not install requested software.
  • Change exposed passwords through known websites, make them unique and turn on two-factor authentication.
  • Contact the bank or card issuer through a known number if payment data was exposed.
  • Review phone permissions, installed apps and account sign-in activity; remove unexpected items.
  • Report the incident to the Federal Trade Commission and the FBI’s Internet Crime Complaint Center (IC3).
  • Use the official fraud-reporting channel of any impersonated carrier, retailer or bank.
  • Keep the original message, package label, screenshots, destination URL and transaction details for investigators.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How widespread are the losses?

The FTC says consumers reported $470 million lost to scams that began with text messages in 2024; fake package delivery was the most commonly reported text scam that year. The FBI’s Internet Crime Complaint Center recorded $16.6 billion in reported consumer losses in 2024, a 33% increase from 2023 cited in a U.S. Treasury cyber-safety advisory.

Best Value
Handheld USB QR Barcode Scanner, NetumScan Wired Automatic 1D 2D Image Bar Code Reader with Adjustable Stand for Store, Supermarket, Warehouse (Wired)
  • ✔Superior recognition ability - Fast accurate reading speed, 32Bit CPU super decoding ability that the speed can up to 300/sec, equiped with upgraded CMOS sensor, which can easily capture 1D/ 2D(QR/ PDF417/ Data Matrix,etc) bar codes from paper and screen, that can read even deformed barcodes, i.e. smudged, damaged, fuzzy, reflective barcodes, etc.
  • ✔Three scanning mode - Key trigger mode + Auto-induction mode + Continuous Mode. There is no need to pull the trigger in auto-sensing mode and continuous scanning. Conbined with handsfree stand, free up your hand thoroughly.
  • ✔Plug and Play - Just plug into a standard USB port and start your scan, no drivers required, no battery; works with Windows, Linux and Mac OS systems. Works with Quickbook, Word, Excel, Novell, and all common software.Note:Not support Square POS!
  • ✔Professional Anti-Shock Silicone Design - The silicone protective cover can avoid the scratches and friction while falling from the height of 6.56 feet; the technical of IP54 sturdy which protect the wireless barcode scanner from dust and moisture.
  • ✔Code Compatibility - Scan 1D barcodes -UPC, EAN, Code128, Code39, Code11, Codabar, Interleaved 2 of 5-Lottery ticket etc; Scan 2D barcodes including PDF417 - drivers license, Data Matrix, QR Code, Micro QR, Aztec code, etc.

On its holiday-scams information page, the FBI cites its 2025 report for more than $503 million in non-payment and non-delivery losses and $282 million in credit-card-fraud losses. These are reported-loss figures, not a measure of every incident, and they cover broader scam categories than QR-code attacks alone.

Questions to ask before trusting any holiday QR code

  • Did I place or expect this order?
  • Can I verify it in the retailer or carrier account I opened independently?
  • Why is a QR code necessary instead of the organization’s normal app or website?
  • Does the page request credentials, payment, a one-time code, an app or a permission?
  • Am I being rushed or threatened with an immediate return or fee?
  • Can I reach support using a number or address I already know?

If the source is unexpected, the channel is embedded, the request is sensitive or the deadline is artificial, treat the QR code as a phishing attempt until an independent channel proves otherwise.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.