A package you didn’t order could be a fun surprise, but be careful, especially if it comes with a QR code. It might be the setup for a scam. In a "brushing" scam, you receive a package you didn’t order, often without a return address. This is often a setup by unscrupulous companies who found your address online. After the company ships the product to you, they can post a fake, positive review on your behalf to improve their store’s ratings and get more sales. Reports to BBB Scam Tracker over the last few months show a twist on brushing scams where the package contains a QR code.
The code comes with instructions to scan it to find out who sent the package or how to start a return. Scanning the QR code can lead to a phishing website or download malware onto your device. In a recent BBB Scam Tracker report, a consumer shared this experience, "I received a small package at my door marked UNIUNI from: LEO This person/company has my name and address - when I googled them the information states this is a brushing scam and that someone has obtained my personal information from either AliExpress, TEMU, or Amazon. I have an Amazon account but have not used those other sites. The label has a tracking number, QR code, customer number, and reference number. I have not opened the package, nor do I wish to - this is highly suspicious. I did not order anything from this company/person." It might seem like there are no downsides to a free package, but it could be a sign that someone is using your personal information for their owngain .