Unsolicited China parcel: is the QR code safe?
Do not scan an enclosed code to identify the sender or arrange a return. Check purchasing and payment records independently, verify any demand with the marketplace or carrier, and report suspicious websites. For supplier dispatch checks in China, contact Cambridge China Bridge.
Identify the parcel without using its code
A card promising to reveal the sender, unlock a gift or arrange collection is not verification. Photograph it alongside the parcel label, keep the packaging and investigate through your usual marketplace account or the carrier’s independently opened website. Our unexpected parcel guide covers the initial checks and handling of delivery mistakes.
Brushing means unsolicited goods sent to support fabricated sales or reviews. Correct recipient details without a recognised order or charge suggest that possibility; a wrong recipient or confirmed addressing error suggests a delivery mistake. Neither a Chinese dispatch address nor an enclosed code settles the explanation. Ask the marketplace to investigate the tracking reference rather than following the card’s instructions.
Check purchases and payment demands separately
Ask purchasing and finance colleagues to compare the parcel with approved orders, samples and replacements. Check marketplace orders, linked wallets, card statements and pending payments through trusted access routes. An unauthorised order or charge needs action even if the parcel looks harmless. Follow our marketplace account recovery guide if account access or purchases are unfamiliar.
Ask anyone demanding payment to provide the order record and explain the charge through a verified contact channel. Keep a seller’s invoice separate from a carrier’s import-charge demand. Use our customs payment message guide to authenticate the carrier’s bill. For a workplace delivery, do not assume that advice about free unsolicited consumer goods resolves your business’s position.
If someone has already scanned the code
Government fraud guidance warns that criminals use QR codes to hide malicious links. If someone has scanned the card, record what happened: whether they only saw an address preview, opened a page, entered details, approved a payment or installed anything. Stop interacting with the page. Do not revisit it merely to gather evidence.
If payment details were entered or money was sent, contact the bank through its usual app or a trusted number immediately. If credentials were entered, change affected passwords through the genuine service and review account access. Tell your workplace technology support team about any download, installation or access permission. Explain the actions taken without assuming that scanning alone proves an account compromise.
Report the website and retain the parcel evidence
Report a suspicious destination website to the National Cyber Security Centre using the reporting route in the official sources below. Use an address already visible in a preview or browser history; do not open the site again to retrieve it. If you cannot identify the destination safely, retain a photograph of the code and ask your workplace technology support team for help.
Government guidance also directs suspicious postal items to Royal Mail’s postal fraud reporting route. Separately, send the marketplace the label, tracking reference and card photographs through its own support channel. Record any collection agreement and reporting references together. Give suppliers a clear instruction that future samples need approval before dispatch, and ask Cambridge China Bridge’s staff in China to check any claimed factory shipment.
Frequently asked questions
Does an unsolicited parcel mean my account was hacked?
No. Check orders, linked wallets and payment records independently. A brushing parcel does not itself prove account access; an unfamiliar order or charge needs urgent investigation.
Should I scan a parcel QR code to find the sender?
Do not use the code as your verification route. Photograph the card and contact the marketplace or carrier independently using the parcel’s tracking reference.
What if I entered my card details after scanning?
Contact your bank immediately through its usual app or a trusted number. Explain what you entered and any payment approved. Stop using the page and retain available evidence.
Where do I report a suspicious parcel QR code?
Report its suspicious destination website to the National Cyber Security Centre. Keep the card and label photographs, notify the marketplace, and use Royal Mail’s reporting route for suspicious postal items.