An unordered package QR code is the subject of a warning from police in Buena Vista, Virginia: a woman reportedly received a cell phone she never ordered, and the package carried a QR code that officers chose to throw away rather than scan. If a parcel like that arrives at your door, the advice is to leave the code alone, check with the supposed sender, and report it. This article covers what was reported, what the police advised, and how a business that legitimately ships products with QR codes can make its own codes easier for customers to trust. We also say plainly what QR software cannot do about someone else's package.
Disclosure: we make D-QR, a dynamic QR code platform. Nothing we sell can stop a stranger from posting you a parcel. The product section below is about brands that send genuine codes.
What was reported
The local station WDBJ7 reported the story on 6 November 2026. According to the article, Cpl. Josh Guttmann of the Buena Vista Police Department said a woman had received a phone she did not order. He described it as a brushing scam, a practice where sellers ship unrequested items so that they can post fake reviews in the recipient's name.
Guttmann reportedly added that some unexpected packages contain codes that lead to malicious websites, or electronics that could carry risk. He warned that plugging an unknown device into a computer could bring malware or let someone pull information from it. In this case, the package reportedly had a QR code on it, and police threw it away so that nobody would scan it by accident. The article does not say where the code led, so we cannot tell you whether it was malicious. We will not guess.
The numbers, such as they are
The report says police had received one formal report of an unexpected package. It adds that, since the warning, other people have told the officer they also received items they did not order. There are no dollar amounts or wider counts in the article, so the scale is unknown. It is a local warning, not a measured campaign, and it is worth reading it that way.
Why an unordered package QR code is a problem
A parcel you did not expect already feels slightly suspicious. A QR code on it removes the one check you would normally make, which is looking at the web address before you visit. On a printed page you cannot see the destination, and phones usually show only a short preview. Scammers know that curiosity does the rest: a free phone, a mystery gift, a request to "confirm delivery". The code does not have to be technically clever. It only has to get one person to open a page and type something in.
If you want the broader picture, our guide on whether QR codes are safe explains what a scan actually does and what it cannot do on its own. We also covered a similar case recently in a Missouri brushing scam warning, which is a different incident with the same pattern.
What to do if an unordered package arrives
The advice attributed to the police in the article is short and sensible. Here is how we would put it into practice:
- Do not scan the code or call any number inside the package. That is exactly what the reported advice says.
- Check with the apparent sender. If the box looks like it came from a large retailer, open that retailer's app or website yourself, check your orders, and report the item you did not order.
- Do not plug in unfamiliar electronics. The officer's concern was malware or data being pulled from a device.
- Tell local police. They can only spot trends if people report. The article also mentions the Federal Trade Commission for suspected scams.
- Keep the packaging and the shipping label. The label can help the retailer or investigators trace where it came from.
Guttmann's summary, as reported, was to stop, take a breath, and verify. That is good advice for any unexpected QR code, not only the ones on parcels. For the mechanics of reading a link before opening it, see how to scan a QR code on iPhone and Android.
What QR software cannot fix
It is worth being honest about the limits. A QR platform only controls the codes created in its own accounts. If a seller somewhere generates a code with any tool and slips it into a box, we have no visibility and no switch to turn it off. The same goes for every other provider. This is a physical-mail problem, solved by recipient caution, retailers policing fake reviews, and police taking reports.
What software can do is help the honest end of the market. Customers are being taught, rightly, to be suspicious of QR codes in packages. Brands that want their legitimate inserts to be scanned need to earn that trust deliberately.
How legitimate brands can make package QR codes trustworthy
Many real products ship with a QR code on the box or an insert: set-up guides, warranty registration, re-order links, manuals. If you are one of those brands, a dynamic QR code helps in several concrete ways, and each of the following is something we can confirm in our product.
Recognisable destinations
On Pro and higher plans you can use a custom domain, so every code opens a page on a domain your customers already associate with you. That matters here because a buyer who is wary of unexpected codes can compare the address with your website. Our guide to using a custom domain for QR codes covers the setup.
Fixing a mistake without a reprint
Printed packaging is expensive to change. A dynamic code can be paused or re-pointed in seconds, and the change applies to every box already out in the world. If a manual page moves, a promotion ends, or something goes wrong, you update the destination instead of reprinting. Codes have no expiry unless you set one, and free-plan codes stay live, which avoids the quiet failure where an old box points at a dead page.
Seeing how codes are used
Every code keeps a scan log with country, city and device, and bot filtering keeps automated previews out of the human counts. Pro plans add scan alerts and webhooks, and you can set a country restriction, a password or an expiry date on an individual code. For a brand, this is a way to notice odd patterns, such as scans from regions you do not ship to, or sudden activity on a product line that has been quiet.
Packaging practices that build trust
- Print the address in words beside the code, not only the code itself.
- State on the insert that you will never ask for a password, payment card or recovery details through the page.
- Match the page branding to your main website so the jump feels continuous.
- Keep a "how to verify this insert" page on your own site that customers can reach without scanning anything.
Our product-packaging page explains how to use QR codes on product packaging and re-point them as products change. For campaign tracking across packaging, retail and print, see QR codes for marketing campaigns and the wider playbook on bridging print and digital.
The takeaway
The Buena Vista warning is small in scale but useful, because it shows the questions an everyday person should ask before scanning anything that arrived uninvited. Who sent this? Did I order it? Can I check the same information somewhere I trust, without using the code? If you cannot answer those, do not scan.
For businesses, the same suspicion is now the baseline. People will not scan a code they have no reason to trust, so give them reasons: a familiar domain, a plain-text address, a clear promise about what the page will never ask, and a destination that actually works. If you want to try that out, you can create a QR code without an account and see the scan log and pause controls for yourself.
Sources
Incident details come from WDBJ7's report on the Buena Vista Police Department warning. Product statements reflect our own plan documentation at the time of writing.