Brushing Scam with QR Code Twist

Overview

Scammers ship you a cheap, unordered item using your real name and address so they can post a fake "verified buyer" review under your identity, and increasingly tuck in a QR code that claims to help you identify the sender or process a return but actually leads to a phishing site.

How It Works

An unexpected package shows up at your door that you never ordered, often containing something cheap and random like baby wipes, toothpaste, or seeds. It may look like it's from a known company like Amazon, or from a person or business you've never heard of. A third-party seller has obtained your name and address without your consent and shipped you the item so the delivery gives them a real tracking number and "proof" of a completed sale, which they use to post a fake five-star review under your name to "brush up" their own ratings. In a newer twist, the package includes a note with a QR code telling you to scan it to find out who sent the package or to process a return — scanning it instead leads to a phishing site designed to steal credit card numbers, usernames, and passwords.

Red Flags

• An unexpected, unordered package arrives addressed to you containing a cheap, random item
• The sender is a business or person you don't recognize, or the package claims to be from a company like Amazon with no order history to match
• A note inside asks you to scan a QR code to find out who sent it or to process a return
• You later find a five-star review posted under your name for a product you never bought

Real Examples

• The FTC's own August 2026 consumer alert describes recent reports of packages containing cheap, random items like baby wipes, toothpaste, or seeds, used to generate delivery confirmations for fake reviews
• That same FTC alert warns that some of these packages include a note with a QR code claiming to help identify the sender or process a return, which instead leads to a phishing site built to steal credit card numbers, usernames, and passwords

Where It Spreads

How to Protect Yourself

• Do not scan any QR code included inside an unexpected package — a legitimate retailer or delivery service never needs this to identify a sender or process a return
• You are not legally obligated to pay for or return items you never ordered — you can keep them
• If the package appears to be from Amazon or another online marketplace, report it to that platform so they can investigate the seller
• Check your accounts on online marketplaces for reviews posted under your name that you didn't write
• Report a brushing scam to the FTC at reportfraud.ftc.gov

Related Scams