A package that shows up with no memory of ordering it might look like a shipping mix-up, but consumer protection regulators say it is often a scam built entirely around that confusion. The Federal Trade Commission is warning that so-called brushing scams, in which strangers ship cheap items to real addresses to generate fake product reviews, have picked up a new and more dangerous feature: a QR code tucked inside the box. Scanning it, the agency says, can lead straight to a site built to steal financial information rather than to any explanation of who sent the package.
A Cheap, Random Item Is the Point
The scam usually starts with something inexpensive and generic, such as baby wipes, toothpaste, or a packet of seeds, mailed to a real name and address the sender obtained some other way. The FTC says the package is often made to look like it came from a familiar retailer such as Amazon, or from a business or person the recipient has never heard of. The seemingly harmless delivery is not a mistake; it is the mechanism. Once the item shows as delivered, the sender can point to that delivery as proof of a real transaction, then post a glowing review in the recipient’s name for whatever product the scammer is actually trying to sell, inflating its ratings without the recipient ever knowing their identity was used for it.
A QR Code Standing In for a Return Label
What has changed, according to the FTC’s alert, is what is sometimes tucked inside the box alongside the item: a printed note bearing a QR code. The note might claim scanning it will reveal who sent the package, or that scanning is required to process a return. Neither is true in the way it is presented. The commission says scanning the code can lead to a phishing site designed to harvest credit card numbers, usernames, and passwords under the guise of a shipping form or identity check. Because the package itself is real and physically arrived at a real address, the QR code inherits a kind of borrowed legitimacy that a scam email or text message does not have; there is a tangible object in hand, which can lower a recipient’s guard before the code is even scanned.
What Happens After the Scan
The FBI’s Internet Crime Complaint Center describes an even more invasive version of the same trick. In a public service announcement, the bureau warned that some unsolicited packages carry QR codes that, once scanned, prompt the recipient to hand over personal and financial details directly, or quietly install malicious software that pulls data off the phone used to scan it. The FBI noted that these packages are frequently shipped without any sender information at all, a deliberate omission meant to make the QR code look like the only way to identify where the box came from. Its advisory told the public to avoid authorizing phone permissions or website access prompted by an unfamiliar code, and to treat any QR code arriving inside an unordered package as untrustworthy by default, regardless of what the accompanying note claims it will do. The bureau also pointed anyone 60 or older who needs help filing a complaint toward the Justice Department’s Elder Justice Hotline, a detail that reflects how often this style of scam is aimed at older recipients.
A Year-Old FBI Warning the FTC Just Revived
The FBI’s warning was issued in July 2025; the FTC’s consumer alert followed roughly a year later, restating the same core mechanism and adding the marketplace-review angle that gives brushing scams their name. Read together, the two alerts describe a scam regulators consider persistent rather than a single incident: a real product, a real delivery, and a fabricated reason to scan a code once the box is opened. Both agencies point recipients toward the same follow-up steps once a code has already been scanned: securing online accounts, watching for unauthorized charges, and pulling a credit report to check for activity the account holder did not initiate.
The Legal Right to Keep It, and the Safer Way to Handle It
Federal law is clear on one part of this: nobody who receives an item they did not order has to return it or pay for it, a protection built into unordered-merchandise rules the FTC enforces. That legal right does not make the item worth using, however; the FTC recommends treating it as unknown in origin rather than a free gift, since accepting or using the product does not carry the same risk that scanning the code does. If a package arrived through a marketplace account such as Amazon, the FTC suggests reporting it to the platform so it can investigate the seller responsible. Anyone who scanned a code and entered information on the resulting site is advised to change passwords across shopping accounts immediately and pull a free credit report at AnnualCreditReport.com to check for signs of identity theft, and both agencies ask that suspected cases be reported so they can track how the scheme is spreading.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
