Unexpected Package Brushing Scams: What to Do Before You Scan Anything

An unexpected package on your porch can feel like a harmless surprise. Sometimes it is a gift. Sometimes it is a shipping mistake. But sometimes it is a brushing scam: a seller or scammer sends an item you never ordered so they can create fake activity, manipulate reviews, or test whether your personal information works.

The newer version is nastier. Some unsolicited packages now include QR codes, fake support cards, prize claims, or "verify your delivery" instructions designed to push you into a phishing page.

The package is not the main danger. The dangerous part is what the sender tries to make you do next.

What is a brushing scam?

A brushing scam usually works like this:

1. A seller or scammer gets your name and address.
2. They ship you a cheap item, empty package, or low-quality product.
3. The delivery creates a record that looks like a real order.
4. They use that record to post a fake verified review, inflate sales numbers, or make a product look more trustworthy.

That alone is bad for online marketplaces, but it also tells you something important: your personal information is being used by someone you did not authorize.

That does not always mean your bank account is compromised. But it does mean you should slow down and check.

The QR-code twist

The most dangerous packages are the ones that try to turn curiosity into action.

Watch for inserts that say things like:

• "Scan to confirm delivery"
• "Scan to claim your warranty"
• "Scan to see who sent this gift"
• "Scan to return this item"
• "Scan to claim a prize"
• "Your account has a delivery issue"

Those codes may lead to fake login pages, fake shipping portals, malware downloads, or payment forms. The scammer is betting that you will scan first and think later because the package is physically in your hands.

Do not give them that opening.

What to do when a mystery package arrives

Start with the boring checks:

1. Ask household members whether they ordered it.
2. Check your Amazon, Walmart, Target, eBay, Temu, AliExpress, Etsy, and other marketplace order histories directly through the app or website.
3. Look for unknown charges on the payment cards tied to those accounts.
4. Check whether the tracking number appears in a real order you recognize.
5. Do not call numbers, scan QR codes, or visit links printed on loose inserts inside the package.

If nothing matches, treat it as suspicious.

You generally are not required to pay for merchandise you did not order. The bigger issue is account and identity safety, not returning the item.

Red flags inside the package

Be especially cautious if the package includes:

• A QR code with no clear official context
• A prize, refund, reward, warranty, or gift claim
• A request to log in to a shipping or shopping account
• A request for card details "to verify" your identity
• A request to download an app from outside an official app store
• Poor grammar, generic branding, or mismatched logos
• No return address, a strange return address, or a seller name you cannot verify

Real retailers do not need a random package insert to collect your password or credit card number.

Check your shopping accounts

Open your accounts directly. Do not use links from the package.

Look for:

• Orders you did not place
• Saved addresses you do not recognize
• Payment methods you did not add
• New logins or devices
• Reviews posted under your account
• Messages from sellers you did not contact

If you find anything strange, change the password, turn on two-factor authentication, remove unknown payment methods, and contact the marketplace through its official help center.

What if the item looks valuable?

Do not let the item distract you from the setup.

Scammers sometimes send cheap items that look more expensive than they are. They may also send electronics, beauty products, supplements, or mystery items that are not safe to use. If the product touches your skin, goes into your body, plugs into your devices, or connects to Bluetooth or Wi-Fi, be cautious.

You do not know where it came from, how it was made, or why it was sent.

What to report

Report the package if it appears connected to an online marketplace account or fake review scheme.

Good places to report:

• The marketplace named on the label or packaging
• The seller platform if you can identify it
• The U.S. Postal Inspection Service if the mail was used
• The FTC at ReportFraud.ftc.gov
• The FBI's IC3 at ic3.gov if a QR code, phishing page, malware, or financial fraud is involved

Include photos of the package, label, insert, tracking number, and QR code, but do not scan the code to "see what happens."

If you already scanned the QR code

Scanning alone does not always mean damage was done. What matters is whether you entered information, installed anything, or granted permissions.

If you scanned but did nothing else, close the page and clear your browser tab.

If you entered a password:

1. Change that password from a clean browser session.
2. Change it anywhere else you reused it.
3. Turn on two-factor authentication.
4. Review account activity and sign out of unknown devices.

If you entered card details, call the card issuer and ask for fraud monitoring or a replacement card.

If you installed an app or file, remove it, run a security scan, and consider getting help before using the device for banking.

A simple house rule

Use this rule with family members:

Never scan a code from a package you did not order.

If the package is real, you can verify it by opening the shopping app, typing the retailer's website yourself, or checking the tracking number through the carrier's official site.

Curiosity is exactly what the scammer is trying to monetize.

Bottom line

An unexpected package is not automatically a crisis, but it is a signal. Your name and address may be circulating somewhere you did not authorize, and the sender may be trying to push you into a second step.

Do not scan. Do not log in from package inserts. Do not pay surprise fees. Verify through official accounts you open yourself.

If you are unsure whether a package insert, QR code, text, or email is real, paste the message or link into HelloAlpha's free scam checker at helloalpha.ai/scam-check before you act.

Sources

• FTC: That unexpected package you got could be a brushing scam
• U.S. Postal Inspection Service: Brushing Scam
• FBI: Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes