Malicious QR code scams are being used in parcel and delivery fraud, warns UK security experts
UK security experts are warning that criminals are increasingly using QR codes as part of parcel and delivery scams. The basic trick is simple: a scam text, email, sticker or fake notice sends people to a fake website or malicious app, often by asking them to scan a QR code. The aim is usually to steal money, personal details, passwords, or banking information. The National Cyber Security Centre (NCSC) says QR-enabled fraud does happen in the UK, and that criminals are also using QR codes in phishing emails to direct people to scam sites. NCSC NCSC
What has happened
Parcel-related scams are not new, but QR codes are making them easier to disguise. The NCSC has previously warned that “missed parcel” SMS messages can lead people to install malware disguised as delivery-tracking apps. More recently, the NCSC has said criminals are using malicious links or QR codes in messaging-app and phishing attacks, and that scammers increasingly copy messages from trusted brands. Which? also reported in June 2025 that Action Fraud had seen reported QR-code scam losses of £3.5 million in 2024. NCSC NCSC Which?
In practice, a scam may look like:
- a text message saying a parcel needs a small extra payment
- an email or message asking you to “confirm” delivery details by scanning a QR code
- a printed QR sticker placed on a parcel notice, parcel locker, car park machine, or fake delivery slip
- a link to a supposed courier app that is actually malware
Why this matters
These scams matter because they exploit a routine moment: waiting for a parcel. People are often busy, expecting deliveries, and less likely to question a message that appears to come from a courier. The NCSC says QR codes can also slip past some email security tools because the dangerous link is hidden inside an image rather than visible text. NCSC
If someone installs malware or enters card details on a fake site, the consequences can include:
- unauthorised card payments
- stolen passwords or account access
- identity fraud
- further scam messages sent to the victim’s contacts
Who may be affected
Anyone who receives parcels could be targeted, but some people may be at higher risk, including:
- frequent online shoppers
- people awaiting important deliveries
- small business owners selling goods online
- older people who may be less familiar with QR-code scams
- anyone receiving delivery texts, emails, or parcel notices that they were not expecting
Which? reported in June 2026 that delivery scams are still a common form of text scam, with messages claiming there is a missed delivery, a delay, or a small fee to pay. Which?
Warning signs to watch for
Be cautious if a parcel message:
- creates pressure to act quickly
- asks for an unexpected payment
- contains spelling, grammar or branding mistakes
- uses a QR code instead of a normal, clearly written official web address
- asks you to install an app from a link in a message
- comes from an unknown number or email address
- does not match a delivery you are actually expecting
The NCSC says criminals are increasingly using QR codes in phishing content, and that suspicious messages should be treated carefully even if they appear to be from a familiar organisation. NCSC NCSC
What readers should do now
If you receive a suspicious parcel or delivery message, do this:
- Do not scan the QR code if you are unsure who placed it there or sent it.
- Do not click links in unexpected delivery texts or emails.
- Go directly to the courier’s official website or app by typing the address yourself or using a trusted bookmark.
- Check your delivery history in the retailer’s official app or website if you have one.
- Contact the courier or retailer through a known official contact channel, not via the message you received.
- Forward suspicious texts to 7726, the UK spam-reporting service.
- Report scam websites or phishing attempts to the NCSC’s reporting services. NCSC NCSC
If you have already entered card details or passwords, contact your bank immediately and change any affected passwords. If you installed an app you now suspect was malicious, follow your phone’s security guidance and seek technical help quickly. The NCSC advises people not to panic, but to act promptly. NCSC NCSC
How to stay safer next time
A few habits can reduce the risk:
- Use the courier’s official app for tracking where possible.
- Keep your phone and apps updated.
- Be wary of any parcel message that asks for money, login details, or urgent action.
- Pause before scanning any QR code in public or in a message.
- Check the sender independently if a message seems even slightly off.
- Consider using card protections such as virtual cards or payment alerts where available.
For businesses, the NCSC has also urged organisations to make customer messages harder for scammers to copy, because fake delivery texts remain a common route into fraud. NCSC
Key takeaway
QR codes are convenient, but they can also hide scam links. If a delivery message feels unusual, do not scan first and ask questions later. Verify it through the courier’s official website or app, and report anything suspicious. NCSC NCSC