There’s something oddly satisfying about receiving a package. It can be a very nice surprise creating excitement about what may be inside. But then, you realize you didn’t order it. The FBI, USPS, and other agencies are warning about this QR Code scam.
Enter the latest, new and improved evolution of a familiar con: the QR brushing scam. Traditionally, brushing scams involved unsolicited packages sent to inflate fake online reviews. You’ve probably read about receiving Amazon packages you didn’t order, but are addressed to you. Now, scammers are adding a digital hook. Inside the box, alongside the mystery item, is a QR code urging you to scan for more information, claim a prize, or identify the sender.
The FBI warns that scanning these codes can direct you to malicious websites designed to harvest login credentials, financial details, or install malware on your device. Think of it as phishing, but with a physical breadcrumb trail leading you straight to the trap.
The danger here is subtlety and perhaps a bit of complacency. QR codes have become part of everyday life, used for menus, payments, and promotions. We don’t put so much thought into them anymore. That familiarity lowers our guard. Unlike suspicious links in emails, a printed code feels oddly trustworthy. Attackers are counting on that split-second assumption.
Once scanned, victims may land on convincing pages that mimic legitimate brands or prompt them to enter sensitive information. In some cases, the code can trigger downloads or exploit vulnerabilities without much user interaction.
Avoiding this scam is refreshingly low-tech. If you didn’t order the package, don’t engage with anything inside it, especially QR codes. Resist the urge to “just see what it is.” If curiosity wins, manually search for the company instead of scanning. And as always, keep your device updated and protected with reputable security software.
Sometimes, the most dangerous link isn’t in your inbox. It’s sitting quietly in a box on your porch, waiting to be scanned.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
