An unwanted package on your porch with a QR code is the tell of a fast-spreading scam

A package shows up on the porch that nobody remembers ordering, holding something cheap like a pair of socks, a phone case, or a handful of seed packets. Tucked inside is a printed note with a QR code, promising that scanning it will reveal who sent the item or let the recipient process an easy return. Federal regulators say that note is the real danger in the box, not the low-value item sitting next to it, and they are warning that the pattern has become common enough to merit a dedicated consumer alert.

The scheme has a name among fraud investigators: brushing.

What a Brushing Scam Actually Does

In a brushing scam, a seller ships cheap, unordered merchandise to real addresses, then uses the delivery to post a fake verified review under the recipient’s name on a marketplace listing, boosting that seller’s ratings without the recipient ever placing an order. According to a consumer alert from the Federal Trade Commission, the packages typically look like they came from a familiar retailer or an unfamiliar small business, and the item inside is usually inexpensive enough that the sender loses little by shipping it to an address that never asked for it. The scam depends on volume: a seller who ships thousands of unsolicited packages and generates even a fraction of that many fake reviews can meaningfully inflate a product listing’s reputation.

The QR Code Turns a Nuisance Into a Threat

Older versions of brushing scams stopped at the unwanted package itself, an annoyance but not a direct security risk. The newer twist regulators are flagging involves a printed QR code inside the box, often accompanied by text suggesting it will reveal the sender’s identity or help process a return or refund. Scanning that code does not lead to sender information at all; instead, it routes to a phishing page built to harvest personal details such as credit card numbers, usernames, and passwords. That shift turns a mildly annoying mystery package into an active attempt to steal financial or account information from whoever is curious enough to scan the code.

The Accounts Most Likely to Be Targeted

Brushing scams tend to exploit whatever address and name a seller can obtain, which in many cases traces back to a data breach or a leaked shipping list rather than any direct online purchase by the recipient. Because the scam is often tied to real marketplace accounts, security researchers advise checking major online shopping accounts, particularly ones with saved payment methods such as Amazon or Temu, for unfamiliar orders or account activity after receiving an unexpected package. If the package appears to have shipped through a specific platform, notifying that platform directly can help it investigate and potentially remove the seller responsible, since brushing violates most marketplaces’ own seller policies as well as consumer protection rules.

Why the FTC Also Points to Credit Reports

Beyond checking marketplace accounts, the FTC’s alert specifically recommends monitoring credit reports on a weekly basis through AnnualCreditReport.com, the government-authorized site that lets consumers pull reports from all three major credit bureaus for free rather than waiting for an annual check. That recommendation reflects a broader concern behind brushing: a package sent to a real name and address usually means a scammer already had enough personal information to find that address in the first place, information that may have come from a data breach, a purchased marketing list, or an account compromise unrelated to the package itself. Reviewing a credit report for accounts or inquiries that were never authorized can catch identity theft that started well before, or separately from, the unwanted delivery.

The scheme also exploits a specific weakness in how online marketplaces rank sellers: platforms weight “verified purchase” reviews more heavily than unverified ones because they are harder to fake, which is precisely the assumption a brushing scammer is exploiting by generating a real, trackable delivery to attach a review to. That is also why notifying the platform matters beyond cleaning up one listing: a seller running a large brushing operation is typically violating the marketplace’s own seller terms in addition to consumer protection law, and a cluster of reports can trigger a platform-side investigation that a single complaint alone would not.

The Legal Right to Keep Unordered Merchandise

One detail regulators emphasize is that recipients of unordered merchandise are not required to pay for it, return it, or otherwise respond to the sender in any way; federal rules treat unsolicited merchandise as a gift the recipient is free to keep, use, or discard. That protection removes any pressure to interact with the item at all, including its packaging, which is precisely why security guidance steers clear of engaging with an included QR code, return label, or customer service number rather than treating any of it as a legitimate next step. The safest response to an unexpected box is to leave the paper insert unscanned and unread beyond confirming there is no immediate safety concern, such as a hazardous or perishable item.

Reporting a Suspected Brushing Attempt

Consumers who receive a package matching this pattern, especially one with an enclosed QR code claiming to identify the sender, are encouraged to document the packaging and file a report through the FTC’s fraud reporting portal, which feeds into a shared law enforcement database used to track scam patterns across the country. The FTC also maintains a broader library of consumer scam guidance covering related tactics, since brushing scams frequently overlap with other forms of phishing and account-takeover fraud that rely on the same basic trick of disguising a malicious link as a helpful shortcut. Reporting individual incidents, even ones that cause no direct financial loss, helps investigators spot the larger sellers and shipping networks behind a pattern that would otherwise look like isolated, low-stakes junk mail.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview