As you are busy receiving last-minute holiday deliveries, be cautious of any packages that you didn’t request or those lacking a return address, especially if they prompt you to scan a QR code: it might be a scam.

These scams, known as brushing scams, have existed for several years and come in different forms. They can range from seemingly harmless activities to those that involve scanning a QR code to learn who sent the package.

Scanning such codes could mislead consumers to websites designed to collect personal information, resembling a phishing scam. Furthermore, some harmful QR codes might even deploy malware that can compromise information stored on a consumer’s device.

This holiday season, law enforcement agencies nationwide are using social media to alert the public about these scams.

How Does a Brushing Scam Work?

Reports of brushing scams began a few years ago when people started finding unsolicited packages at their homes. When consumers reached out to retailers like Amazon for clarification, they were often told to keep the items, even if they weren’t ordered.

Most of these unsolicited packages originate from Amazon third-party sellers, and a representative stated that the company takes measures against these sellers.

According to Jennifer Leach, associate director of the Federal Trade Commission’s Bureau of Consumer and Business Education, the goal of these sellers is to enhance their ratings.

“Dishonest sellers are sending various unwanted items by mail and then posting positive reviews for their business in your name,” Leach remarked.

She added, “This hurts legitimate businesses that earn reviews honestly, and it poses risks for you as well. Receiving these items could indicate that a scammer has opened accounts using your information, either overtaking your account or creating new ones linked to your address.”

Although victims of these scams are often not “harmed” in the conventional sense, since they typically receive the item for free, some might label brushing scams as “victimless.” However, the goods received are usually low-value items that consumers might not want, such as ping pong balls or flashlights.

Moreover, prospective buyers considering reviews from the seller who sent these packages could end up making poor purchasing choices based on inflated reviews.

What Should I Do If I Receive an Unordered Package?

If an unexpected package arrives, there are steps you can take to safeguard your identity, advised Melanie McGovern from the Better Business Bureau.

“First, inform the retailer about the package, review your account for any recent orders, and update your passwords,” McGovern suggested. She also urged consumers to report the incident to the BBB’s Scam Tracker at www.bbb.org/scamtracker to alert others.

Leach from the FTC advised ensuring that there are no issues with your online accounts.

An Amazon spokesperson reiterated their position on brushing scams: “Third-party sellers are not allowed to send unrequested packages to customers, and we act against violators of our policies by withholding payments, suspending selling privileges, and alerting law enforcement.”

Amazon recommends that if you receive an unordered package, verify with friends or family to rule out any gifts. If the package is addressed to someone else, contact Amazon customer service.

If you confirm that you didn’t order the package and no one you know did either, report it online via the “Report Unwanted Package” form on Amazon at https://account-status.amazon.com/report-unwanted-packages.

“Amazon investigates ‘brushing’ reports and takes action against violators, which includes suspending or terminating selling accounts, withholding payments, and coordinating with law enforcement. Customers do not have to return these items,” stated the Amazon representative.

What Is a QR Code Scam?

Another form of brushing scam may also come without a return address, but it will include a QR (quick response) code instructing you to scan it to identify the sender.

QR code scams are not a new phenomenon. However, as the use of QR codes has grown — serving numerous functions from displaying a restaurant menu to processing parking fees — so have the scammers.

If you receive a package you weren’t expecting or didn’t order, the FTC advises against scanning the QR code.

“A scammer’s QR code might redirect you to a fake website that seems authentic but isn’t. If you log onto that site, the scammers can acquire any information you provide,” the FTC elaborated in a blog post in 2023. “Additionally, the QR code could install malware that captures your information without your awareness.”

Understanding Smishing Scams

The U.S. Postal Inspection Service has recently issued a warning, encouraging customers to refrain from engaging with text messages that claim your package is lost or provide tracking details for an order you did not place.

Smishing, a variant of phishing, involves deceitful messages designed to look like they are from trusted sources, tricking individuals into exposing their personal or financial information, as highlighted earlier by YSL News.