WASHINGTON, DC — Consumers who receive a package they never ordered may be seeing more than a harmless delivery mix-up. The Federal Trade Commission has issued a new warning about brushing scams, a scheme in which people get unsolicited packages that can indicate their personal information has been compromised.
The agency says a newer version of the scam adds a QR code to the box or insert, with prompts such as “scan to return” or “scan to find out who sent the package.” The FTC says those codes can send people to phishing sites built to steal sensitive data, including credit card numbers, usernames, and passwords.
How brushing scams work and why surprise deliveries matter
Brushing scams are designed to make it look as though a product was legitimately ordered and delivered, even when the recipient never placed an order. The FTC says an unexpected package can be a sign that someone has gained access to personal information and is using it in a way the recipient did not authorize.
While the packages may seem harmless, they can expose deeper problems. A consumer who receives an item they did not request should treat the delivery as a warning sign rather than a free gift, especially if the package appears to be part of a pattern rather than a one-time mistake.
The agency’s warning reflects a broader concern that scammers are using ordinary shipping practices to create confusion and push people toward actions that put their financial accounts at risk.
Why QR codes on packages can be dangerous
The FTC says the QR-code version of the scam is especially concerning because it can encourage people to act quickly without checking the sender or destination. Messages telling consumers to scan for return instructions or to identify who sent the package may appear helpful, but they can be a trap.
Once a person scans a malicious code, they may be taken to a phishing website designed to collect login credentials, payment information, or other private details. The agency specifically warned that scammers may try to capture credit card numbers, usernames, and passwords through those fake sites.
The advice is simple: do not scan a code just because it appears on an unexpected delivery. The FTC says the code itself may be the path the scam depends on.
What the FTC says to do if you get something you never ordered
The commission says recipients should change passwords for online shopping accounts if they receive an unsolicited package. It also recommends reviewing credit card statements closely to make sure no unauthorized charges have appeared.
Consumers should not assume they are required to pay for the item or send it back. The FTC says the law does not require recipients of an unordered package to return it, which means people should be cautious about instructions that pressure them to act fast.
If a package contains a QR code or asks for personal information, the safest move is to avoid interacting with it until the delivery can be verified through a trusted channel.
Why scammers target shopping habits and delivery systems
The FTC’s bulletin fits into a larger pattern of scams that exploit the way people shop and communicate online. Delivery notifications, return instructions, and account verification prompts are all familiar enough to seem legitimate, which makes them useful tools for fraud.
By attaching a QR code to an unexpected package, scammers can create a sense of urgency and curiosity at the same time. That combination can lead people to bypass the caution they might normally use when opening a suspicious email or text message.
The warning also shows how fraudsters keep adapting. A delivery that looks routine on the outside can still be part of a wider attempt to gather personal information or confirm that a target is responsive.
FTC advice adds to broader warnings about online fraud
The package scam alert comes as the FTC continues warning consumers about digital fraud tied to everyday platforms and services. In related guidance, the agency has said social media scams caused more than $90 million in losses in 2025.
That broader backdrop helps explain why the commission keeps pushing basic defensive steps: use strong passwords, check financial statements, and be skeptical of messages or codes that try to move people off familiar platforms. The common thread is to verify before clicking, scanning, or responding.
For consumers, the key takeaway is that an unexpected delivery is not automatically harmless. The FTC says it can be a clue that someone is trying to use your information in a way you never approved.
Leave a Reply