Week 24: Phishing in the letterbox – Fake QR codes on collection notices

16.06.2026 - Last week, the NCSC received a report of a sophisticated scam combining a physical document and digital phishing techniques. Scammers place fake Swiss Post collection notes, known as "Avis de passage", in people's letterboxes.

Scammers usually rely on the anonymity of the internet: they hide their identity, cover their tracks and reduce the risk of being arrested. They also tend to avoid operating from within the country where their victims live. Nevertheless, the NCSC regularly receives reports of cyberattacks that also involve analogue means of communication. Examples include stickers with fake QR codes placed on parking meters and fake text messages about parking fees sent via SMS blasters. Currently, scammers are placing fake collection notes in letterboxes. Victims first find a document in their letterbox that closely resembles the genuine yellow collection note used by Swiss Post. This document imitates Swiss Post's colours and logo, and contains plausible information about an alleged failed parcel delivery. To arrange a new delivery, recipients are instructed to scan a printed QR code.

Fake collection note with QR code found in someone's letterbox.

Victims are lured into the digital space and led to a fake website that is almost indistinguishable from the genuine Swiss Post site. The site claims that a parcel has been held and that a new delivery must be arranged. It states that additional information is required before the delivery can be rescheduled.

Choosing a new delivery window makes the scam feel more convincing.

Victims are then asked to select a new delivery slot. This step is only there to distract them from the real purpose of the scam, which is to collect extensive personal information, including their name, date of birth, postal address, email address and, as a mandatory field, a Swiss phone number.

The website asks for a lot of personal information, including your date of birth.

The payment trap then snaps shut. Victims are asked to pay an alleged processing fee for the supposed new delivery, usually CHF 2.10. Interestingly, this amount can sometimes change slightly during the payment process, for example jumping to CHF 3.99. The real aim is to steal credit card details, as payment can only be made by credit card. Although the fake page displays alternative payment methods, such as TWINT, these do not work and are marked as "indisponible" (unavailable).

Finally, victims are asked to enter their credit card details, which are then used to make a fraudulent charge.

Why the scam works

A Swiss Post collection note feels familiar, and that is exactly what makes it so dangerous in this case. Because people know these notes from everyday life, they unconsciously fall back on familiar routines. The scepticism that many people have developed towards emails and text messages does not apply when they open their letterbox. Hardly anyone expects a familiar-looking postal note to be part of a cyberscam. The idea of an undelivered parcel also creates curiosity and a sense of urgency. Everyone is eager to get hold of their parcel. It only being a small fee of just a few francs is also deliberate.

Scammers have two aims in these attacks. Firstly, they collect large amounts of personal data, which can later be used for identity theft. Secondly, they obtain credit card details, which they then use to make fraudulent payments. So far, the NCSC has only received reports of fake collection notes like the ones described here from French-speaking Switzerland.

Taking a scam into the physical world increases the risk of those involved being caught in the act by the police. That is why scammers usually outsource these tasks to recruited individuals, who often have no idea that they are taking part in a crime.

Recommendations

Swiss Post does not usually charge a fee for a standard second delivery attempt.
Be very careful when scanning QR codes found on unexpected physical documents. In particular, check the web address that opens.
To manage mail items or check collection notes, always go directly to the official Swiss Post website or use the official Swiss Post app. Instead of scanning the QR code, enter the consignment number manually in the tracking tool on the Swiss Post website or app. If the number does not exist, it may be a scam.
If you have entered personal information or payment details on a website like this, contact your bank or credit card issuer immediately and have the card blocked.
You do not need to provide your date of birth to have a parcel delivered.