Brushing scam: a package you didn't order, sometimes with a QR code

What the message looks like

How this scam works

In classic brushing, a third-party seller ships low-cost items to real addresses so it can record a 'delivered' order and post a fake positive review as if you were a verified buyer. The Postal Inspection Service says the goal is to inflate a product's ratings and sales. It also means someone has your name and address, and possibly more.

The newer twist adds a QR code. In a July 2025 public service announcement, the FBI warned that some unsolicited packages include a QR code leading to a page that asks for personal and financial information, or to software that steals data from your phone. The BBB says the code may promise to show who sent the gift or how to start a return. In one BBB Scam Tracker report, a woman who scanned such a code landed on a page that looked like Amazon and then got more scam emails than usual.

Buena Vista police also cautioned that unexpected electronics could carry malware if plugged into a computer or phone. The FBI notes the QR variation isn't as widespread as other fraud schemes, so a surprise box isn't a crisis, just something to handle calmly.

Red flags

• A package addressed to you that you, and anyone you know, didn't order.
• No sender information, or a seller name you can't match to any of your orders.
• A card or label with a QR code you're told to scan to find out who sent it, start a return or claim a reward.
• A request to pay for the item, or a later bill or call about merchandise you never ordered.
• Electronics, like a phone or USB device, that you're invited to plug in.

How to tell it’s fake

1. Check your own accounts at the retailers you use by opening their app or typing their address yourself. If there's no order, it's unsolicited.
2. Ask family members, especially anyone who shares your address, whether they sent a gift.
3. Look for reviews in your name on the seller's product page. The BBB suggests reporting any you find to the retailer.
4. If someone calls or emails about the package and it sounds believable, get a second opinion from a scam expert before you give any details.

What to do if you clicked, paid or shared info

Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.

If you clicked a link or called back

• If you scanned the code but didn't type anything, close the page and don't install anything it offers.
• If you entered passwords or installed an app, change those passwords from another device, turn on two-factor authentication and remove the app.

If you paid

• You don't owe anything for unordered merchandise. If you paid a bill or a 'release fee', call your card company or bank using the number on your card and dispute the charge.

If you shared personal info, a password or a code

• If you gave personal or card details, the FBI suggests getting free credit reports from Equifax, Experian and TransUnion to look for fraud. Watch card bills closely and consider a credit freeze.
• Report the package to the retailer it came through so it can investigate the seller and remove fake reviews.

How Gmork Scam Guard would warn you

Scam Guard runs in Chrome and Edge on your computer, so it can't scan a QR code on a card with your phone camera. If you open the code's web address on your computer, or get a follow-up email about the package, it checks the page and warns you about lookalike retailer logins and requests for card details.

Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.

Usar no ChromeAdicionar ao EdgeAdicionar ao FirefoxAdicionar ao Opera

Questions people ask

Do I have to pay for or return a package I didn't order?

No. The Postal Inspection Service says that by law you may keep unsolicited merchandise and don't have to pay for it. You can also throw it away if it's safe to, or mark an unopened package with a return address 'Return to sender' and USPS will return it free. Don't open seeds, food or unknown liquids; notify the authorities instead.

Does a brushing package mean my account was hacked?

Not necessarily, but someone has your name and address, perhaps from a data leak or public records. The Postal Inspection Service suggests changing your account passwords and watching your credit reports and card bills as a precaution.

Is it safe to scan the QR code to find out who sent it?

Don't scan it. The FBI and BBB both warn that these codes can lead to phishing pages or malicious software. If you want to know where it came from, check your own retailer accounts or ask family members instead.

Sources

• U.S. Postal Inspection Service: Brushing scam
• FBI PSA I-073125-PSA: Unsolicited packages containing QR codes used to initiate fraud schemes
• BBB Tip: Don't scan QR codes on unexpected packages
• WDBJ7 (Nov 7, 2026): Buena Vista police warn of possible scam involving unordered packages