A package shows up at your door. You did not order it. Inside is something small - a pack of seeds, a pair of cheap earbuds, a box of baby wipes - and a card that says “scan this code to find out who sent it.” Do not scan it.
I know how tempting that card is, because I know how the package feels. It does not feel like a threat. It feels like a mystery, or maybe a mix-up, or maybe a gift from someone who forgot to sign the note. You want to solve it. That is exactly what the people who sent it are counting on.
Two days ago, on August 20, the Federal Trade Commission warned about this exact package. It is called a brushing scam, and some of these packages now come with a QR code that leads to a fake website built to steal your passwords or your card number.
This is the newest costume in the scam series we have been tracking. The first article covered the fake bank call, the second covered the recovery call that comes after a scam, the third covered the gold bar scam, and the fourth covered the paid-search bill. This one is different from all of them: it does not need a phone call, a text, or a search box. It arrives on your doorstep, addressed to you by name.
Here is how the script runs, the two tells that give it away, and the habit that ends it.
The Script, Step by Step
Step one: the package
It is small, it is cheap, and it has your name on it. Baby wipes. Seeds. A phone case for a phone you do not own. These are the kinds of items the FTC says show up. There is no return address you recognize, or the label looks like it came from a marketplace you have used.
It is addressed to you. That is the detail that does the work. A package with your name on it feels personal, and personal feels safe.
Step two: the card
Inside, next to the item, there is a card. “Scan this code to find out who sent your gift.” Or “Scan to track your package.” Or “Scan to return this item and claim your reward.” Something friendly, something helpful, something that sounds like customer service.
That little square of black and white is the whole scam in one shape. The package is bait. The code is the hook.
Step three: the page
You scan the code with your phone, and it opens a website. The site looks like a delivery company, or a bank, or the marketplace itself. It asks you to “confirm” your address so the sender can be found. Or it asks for your card number to pay a small “return fee.” Or it asks you to log in to “your account” to see who sent the package.
None of that is real. The site belongs to the people who sent the package. Everything you type into it goes straight to them.
Step four: the lie behind the package
Here is what the package was for all along. It is not a gift and it is not a mistake. It is a prop.
Brushing works like this. A seller wants five-star reviews for a product, but real reviews are hard to come by. So the seller takes your name and address - they are not hard to find - and ships a cheap item to you, addressed to you, sometimes through a marketplace that records your “purchase.” Then the seller posts a glowing review in your name. “Verified purchase,” it says. The review is a lie, but it looks real, because a package really did go to a real address.
The packages are real, and the practice is not rare. QR-code tricks are the fastest-growing scam in the security reports: Microsoft counted 7.6 million QR-code phishing attacks in January, and 18.7 million by March. Your package is one small piece of a very busy industry.
Step five: what happens next
Two things can happen after the package arrives, and both are bad in different ways.
If you scan the code and type anything in, the scam moves from your mailbox to your accounts. Passwords, card numbers, answers to security questions - whatever the fake page asked for is now in a stranger’s hands.
If you do not scan it, the damage is quieter: your name and address just moved to a list that gets passed around. More packages may come, and so may calls and texts - a list of people who open mystery packages is valuable. That is why reporting matters.
Why It Works So Well
The package scam hides inside good manners. We are raised to be polite, to solve mysteries, to not let a gift go unthanked. A package with your name on it triggers all of that at once.
It also hides inside the way we shop now. Wrong addresses happen. Gift mix-ups happen. Ordering something for a friend and forgetting it happens. The mystery is plausible, so the polite thing feels like the safe thing. Scan the code, find the sender, send a thank-you, done. That is the whole trap.
And the QR code itself does something clever: it skips the step where you would normally check. With a link on a computer, you can hover over it and see where it goes. A code on a package just takes you there - one scan, and you are on the page, with no address to check first. Security companies call it quishing - one of the fastest-growing tricks of the past two years.
The people running this are not betting on your fear. They are betting on your curiosity, your politeness, and your habit of trusting things that arrive with your name on them.
The Two Tells That Give It Away
That is the whole test, in two sentences.
Tell one: the package. You did not order it, and nobody in your family ordered it. That is not a mystery to solve - it is a delivery to ignore. Before you treat anything as a gift, check your own order history and ask the people who would send you one. If nobody claims it, the package is not a gift. It is inventory for a lie about a product you never bought.
Tell two: the code. A real gift does not need you to scan anything to identify the sender. A real delivery company does not need your card number to “return” an item you did not order. Codes from strangers are never the way to solve a mystery - they are the way the mystery gets its hooks into you. If the card asks you to scan, the card is the scam.
What to Do at Each Step
If a package arrives that nobody ordered: do not scan anything. Put the card aside. Then check your own order history and ask your household. Nine times out of ten, that is the whole answer: nobody ordered it.
Keep the item or throw it away. This part is free and legal. When something you did not order shows up in the mail, it is yours to keep - you do not owe anyone for it, and you never have to send it back. The US Postal Inspection Service says it plainly: keep it or safely discard it, but do not pay to return it and do not contact the sender. And if the item is something you would put on your skin or in your mouth, do not use it - you do not know where it came from.
If the item came from a big marketplace, report it there. Amazon, for one, has a “Report Unwanted Package” form - brushing scams use its name, and reports help the marketplace find the seller behind them.
Change the passwords on your shopping accounts. Your name and address were used without your permission - that is a sign the account may be part of the problem. A fresh password on each shopping account is ten minutes of work and closes a door you did not know was open. Use a different password for each one - a password manager makes that painless.
Report it at ReportFraud.ftc.gov. Ten minutes. It will not stop the fake reviews, and I am not going to pretend it will. But the FTC’s warning about this exact package started with consumer reports, and every report is how the next pattern gets caught. You can also check your credit report for free once a week at AnnualCreditReport.com - the only free site the government backs.
If It Has Already Happened
If you already scanned the code and typed something in, here is what actually helps, in order.
If you entered a password: change it right now - on the site you were trying to log in to, and on every account that uses the same password. This is the one time speed beats thoroughness.
If you entered your card number: call the number on the back of your card. Tell them what happened - a fake website took the number. They have heard it before, and they can watch for charges and replace the card.
If you paid a “return fee” or a “delivery fee”: dispute it. You did not order the item, you never owed a fee, and card companies handle disputed charges like this every day. Call the number on the back of your card and start the dispute today.
Then report it at ReportFraud.ftc.gov, and tell one person you trust. The same secrecy that powers every scam in this series is what makes the follow-up call work. The person who knows what happened is far less likely to be hit by what comes next.
The One Conversation
If this is your parent or grandparent, have the same short conversation from the rest of this series, with the package version added:
“If a package shows up that nobody ordered, do not scan the code inside. Check with me first, and we will figure it out together.”
That is the whole conversation. If a package has your name but not your memory, treat the code inside like a stranger at the door. You would not hand a stranger your house keys. Do not hand a stranger’s code the keys to your accounts.
What to Do Now
Take the next step today, whichever one fits:
- If you get packages often: tell your household the rule today. “Nobody ordered it - nobody scans it.”
- If a mystery package is sitting on your table right now: check your order history before you do anything else.
- If you already scanned a code: change the password you typed in, and call the number on the back of your card if you typed a card number.
Remember the two tells. A package you did not order is not a gift. And a code from a stranger is a key, not a clue.
A gift from a stranger is not a gift. It is bait with a bow on it.
This is the fifth article in the Scam Awareness series. More coming - if there is a scam you keep hearing about and want explained, let me know and I will write it up.
If this helped, there is more where it came from. The Basic Hub sends one practical guide a week - no spam, no jargon. Sign up below so the next one finds you.