Mysterious Package on your Doorstep? Make Sure It’s Not a Brushing Scam

You come home and discover a package on your front step even though you didn't order anything. There's no return address or sender information, only a QR code and your name and address are printed clearly on the top. What do you do? 

First off, don't scan that code. Although it sounds like the beginning of a mystery novel, cases like these have been reported nationwide over the last few years, and it's a scam called "brushing."¹

While sending free stuff seems like an odd way to scam people, it's been used as a technique to improve fake reviews. After scammers "brush" your address from the internet, they send you free items using your information to write more convincing fake reviews as "verified users." 

They have your address, but you got free stuff. So what's the fuss?

Recently, these scams have started to evolve, adding a QR code to tempt you with sender information. But once you scan that code and click the link, scammers can swipe information from you, including bank information.² 

Brushing comes with good news and bad news. The good news is whatever is sent to your address is yours to keep, whether it's an iPad or a pair of socks. The bad news is this means your information is available, and scammers want more. 

The trick is to not let your curiosity get the best of you. Here are a few tips for resisting giving scammers more information. 

Generally, it's best not to scan a QR code unless it's been verified. And unless the code on your mysterious package comes from a family member, friend, or other known source, it's best to proceed with caution. Scammers today can use old phishing tactics with newer QR tech to make fake websites and phony codes shockingly easy.³ 

If you become the target of a brushing attack, there's a good chance scammers already have some of your critical information. Even after you change the passwords to your home Wi-Fi, bank, and personal accounts, it's smart to keep a close eye on everything to make sure everything's safe. 

Brushing is a perfect example of how online tactics evolve and change. While a package on your doorstep may seem like a victimless crime, the reality is that these "free" deliveries actually cost you valuable personal information. 

By staying cautious and following the steps outlined—avoiding QR codes, confirming the source, and securing your accounts—you can protect yourself from the hidden dangers of these scams. Stay vigilant, and always remember: if it seems too good to be true, it probably is.

Brushing is a perfect example of how online tactics evolve and change. While a package on your doorstep may seem like a victimless crime, the reality is that these "free" deliveries actually cost you valuable personal information. 

By staying cautious and following the steps outlined—avoiding QR codes, confirming the source, and securing your accounts—you can protect yourself from the hidden dangers of these scams. Stay vigilant, and always remember: if it seems too good to be true, it probably is.

• Online Scams to Watch For
• Rental Scams: Everything you need to know
• Beware of Love Scams
• AI Scams Are Targeting Grandma (And You Too)

1. United States Postal Inspection Service, "Brushing Scam," Published October 25, 2023. Accessed September 10, 2024. 
2. ABC7 Eyewitness News New York, "Tips on how to avoid being scammed by QR codes from unexpected gifts," Published August 29, 2024. Accessed September 10, 2024. 
3. Social Security Administration, "Protecting Yourself from QR Code Fraud," Published February 23, 2024. Accessed September 10, 2024.