QR codes encode arbitrary text, most commonly web addresses. Because a human eye cannot read the encoded pixels of a matrix barcode, users cannot evaluate the destination URL before aiming their smartphone camera at it. Criminal syndicates take advantage of this blind spot by pairing authentic-looking postal branding with urgent prompts.
The scheme often starts through smishing and parcel scams, unsolicited SMS notifications claiming a shipment cannot reach its final address due to an incomplete street name or unpaid customs fee. Increasingly, however, the fraud has moved into the physical world. Fraudsters walk through suburban neighborhoods and urban apartment corridors, affixing a fake failed delivery alert directly onto front doors.
Each notice displays an eagle logo, a barcode, and instructions urging the resident to scan immediately to reschedule delivery within 24 hours. The resulting malicious URL redirect takes the smartphone browser to an off-domain mirror site, often hosted on bulletproof servers with names like `usps-redelivery-tracking-post.com` or spoofed subdomains. Once on the counterfeit page, visitors are prompted to confirm their name, address, Social Security number, and credit card details to cover a minor "handling surcharge."
