Last Updated on December 28, 2025 11:47 am
Law enforcement officials are warning residents about a “brushing” scam that involves unexpected packages containing QR codes designed to steal personal information.
The scam works by sending low-cost items to recipients who did not order them. Inside the package is a QR code that, when scanned, directs the victim to a fake website designed to harvest personal information such as passwords, financial data, or other sensitive details.
The packages typically arrive with no return address, making it difficult to identify the sender. Scammers are counting on recipients' curiosity to prompt them to scan the QR code to learn more about the unexpected delivery.
How to Protect Yourself:
Never scan QR codes from unexpected packages. Treat them the same way you would treat suspicious email links or text messages.
If you receive unordered merchandise, your personal information may have been exposed in a data breach. Change your passwords immediately, especially for online shopping accounts.
Check your online shopping accounts directly by logging in through official websites or apps to verify whether any legitimate purchases were made.
If you cannot identify where a package came from, discard it. Do not attempt to contact the sender or scan any codes included with the package.
Why Scammers Send Packages:
In traditional brushing scams, sellers send unsolicited items to create fake verified purchase reviews online. However, this newer variation adds the dangerous element of QR codes that can compromise victims' personal information and financial accounts.
The presence of unordered merchandise may also indicate that your personal information, including your name and address, has been compromised in a data breach. Recipients should take immediate action to secure their online accounts.
What to Do If You've Been Targeted:
If you have already scanned a QR code from an unexpected package, take the following steps immediately:
Change passwords for all online accounts, especially banking and shopping sites
Monitor your credit card and bank statements for unauthorized charges
Run a security scan on any device used to scan the code
Consider placing a fraud alert on your credit reports
Report the incident to local law enforcement
Residents who receive suspicious packages or believe they have been targeted by this scam should report it to local law enforcement and file a complaint with the Federal Trade Commission at ReportFraud.ftc.gov.
