The U.S. Postal Inspection Service recommends that people who receive unwanted packages monitor their finances for signs of compromised information and change their passwords for online retailers such as eBay, Amazon and Etsy. They can return, toss or keep the items but should never scan the QR codes.
Victims should also report fake codes to the retailer, the Federal Trade Commission and the Postal Inspection Service for any mailed items.
An Amazon spokesperson said the online retailer prohibits unsolicited deliveries and acts swiftly to suspend and report third-party sellers who violate the policy.