Holiday QR Code Scams: What to Watch for on Flyers and Ads
Learn which flyer QR codes to skip, how to check a link, and where to report a suspicious package.
Holiday flyers, gift packages, and ads with QR codes can hide quishing, which is QR-code phishing that sends you to fake payment sites or installs malware. Watch for unordered packages, stickers placed over printed codes, and flyers that press you to scan right away. The U.S.
Postal Inspection Service describes quishing as QR-code phishing using physical images in busy places or codes sent by unfamiliar email or text urging immediate scanning, according to its identity fraud guidance. Anyone who gets flyers, gifts, or ads with unsolicited codes can be affected. A quick pause helps you check before you scan.
Verification note: Program terms and availability can change. This page was checked against linked sources on November 05, 2026.
Why holiday mail and ads draw attention
Holiday volume makes a strange package or flyer look normal. Shoppers expect samples, prizes, and delivery notices. A code that promises tracking, returns, or a bonus fits that mood.
Codes also appear where you cannot check the sender. A flyer on a door, a table at an event, or a parking sign gives little context. The Federal Trade Commission warns that scammers cover legitimate parking-meter and pay-station codes with their own stickers, so scanning sends drivers to fake payment sites that steal money and personal information, according to its September 2026 alert.
The same sticker trick can appear on flyers and ads.
How unordered packages use QR codes
Brushing means delivery of an unordered package so the seller can post a fake verified-purchase review in your name, with recent reports adding a QR code to identify the sender or start a return, according to the Better Business Bureau in its tip on unexpected packages. The code may sit on a card, flyer, or packing slip. It looks helpful, but its job is to get a scan.
Scanning that code can route you to a phishing site harvesting card numbers, usernames, and passwords or installing malware. The FBI warned on July 31, 2025 that criminals mail unsolicited packages containing a QR code that prompts entry of personal and financial information or unknowingly downloads malware that steals phone data, according to its alert on unsolicited packages. Do not text or call numbers listed with the package to provide more details.
How do you spot a risky code before scanning?
Look at placement first. A sticker over a printed code, a code pasted on a flyer edge, or different paper around the code deserves caution. On meters and pay stations, a raised edge or mismatched frame often signals a cover sticker.
Read the message for pressure. Urgent phrases like scan now, claim today, or avoid a fee push fast action. Flyers tied to gifts, refunds, or missed deliveries use the same rush.
- Preview the link on your phone before opening it, and check for misspellings or odd domains.
- Use the merchant or agency contact you already have, such as its own website or the number on your receipt.
- Skip codes from unordered packages, unexpected texts, or flyers with no clear sender.
- Compare the code area with nearby signs for mismatched colors, borders, or glue marks.
What should you do instead of scanning?
Leave the package code unscanned and keep the item separate from your regular mail. Find the seller or agency through a channel you trust. Type the website address yourself rather than following the code.
FBI Cleveland's Nov. 25, 2025 holiday-shopping warning tells recipients of unsolicited packages not to scan enclosed QR codes, text, or call listed numbers to provide added information. Alerts are based on consumer reports, so not every unordered package or flyer code is malicious.
The FBI alert says to report fraud to ReportFraud.ftc.gov and ic3.gov.