A cheap box on the porch with no order history is usually a brushing scam or a phishing setup, and the Federal Trade Commission is warning that QR codes tucked inside the packing slip are the latest way crooks harvest payment credentials from curious recipients.
Brushing schemes start with merchandise you never bought: baby wipes, seeds, cheap gadgets. Sellers—or middlemen trying to boost fake storefront reviews—ship to real addresses so marketplaces show a “verified purchase.” The package itself may be harmless, but fraud rings increasingly add a note urging you to scan a code to “confirm delivery” or claim a refund. That code bypasses your usual skepticism because it feels like a logistical step, not an ad.
Why QR codes are worse than spam links
Phone cameras jump straight to a URL without showing the domain first. The FTC’s consumer alerts note that codes in unexpected packages have led to look-alike payment pages that mimic Amazon, UPS, or card issuers. Once you type a password or card number, the damage is done; unlike a mistaken tap on email spam, you may not have a mail filter warning you.
Some packages are purely about fake reviews; others are paired with stolen personal data from older breaches so the shipment looks eerily targeted. Either way, the safe move is identical: do not scan, do not pay return postage unless a merchant you trust confirms you owe it, and keep the packaging if you file a report.
What to do instead
If you are worried about account security, open the retailer or carrier app you actually use and check order history there—never through a code on a stranger’s label. For credit cards, call the number on the back of your physical card, not a number printed on the mystery note. Enable multi-factor authentication on shopping accounts before holiday buying season accelerates.
You may legally keep unordered merchandise under FTC guidance, but document what arrived. Report brushing and phishing attempts at ReportFraud.ftc.gov so investigators can tie patterns together. If you already scanned a code and entered credentials, change passwords, notify your card issuer, and review statements for micro-charges used to test stolen numbers.
Red flags heading into the holidays
September and October alerts also cover spoofed car-dealer sites and fake farm-equipment listings that demand wire transfers; the QR twist is the same social engineering with a different interface. Legitimate carriers rarely demand payment through a code slip inside a random box. When a deal or delivery story pressures you to act in minutes, slow down—that urgency is the scam.
Curiosity is the exploit. Treat surprise packages like unsolicited attachments: interesting, maybe, but not something to open with your financial keys.