WASHINGTON, June 28 (DC Times Online) — If an unexpected envelope or small package lands in your mailbox, federal consumer and postal agencies say one rule matters most: do not scan any QR code inside it until you know who sent it.
The warning is tied to a scam known as brushing. The U.S. Postal Inspection Service says brushing scams are illegal in the United States. In a brushing scheme, a seller sends items people did not order or request, often after finding the recipient’s address online. The goal is not the item itself. It is to make the recipient look like a verified buyer so the seller can post fake positive reviews in that person’s name.
The Postal Inspection Service says the tactic can help third-party sellers make their products appear more trustworthy than they are. It says the practice has been used by some international sellers as well.
Why the QR code is risky
The Federal Trade Commission warned in January 2025 that an unexpected package with a QR code can be a new twist on brushing. In that alert, the agency said scanning the code could send someone to a phishing website or trigger malware on a phone or computer.
The Postal Inspection Service uses a similar term for the QR-code version: quishing. That is a mix of QR code and phishing. In this setup, the code may be printed on a card inside the mailer and presented as a way to identify the sender or learn more about the company. But the code itself can be the trap.
What brushing is trying to do
A brushing scam is about creating fake proof of a real customer. If a seller can make it look as if a person bought and received an item, it can then post a positive review in that person’s name. Those reviews can help the seller trick other shoppers.
That is why the Postal Inspection Service says the item may arrive even though the recipient never ordered it. The package or envelope is part of the fraud, not a gift.
What to do if one shows up
The Postal Inspection Service says people who receive unsolicited merchandise should report it to the agency. It also says recipients may keep unsolicited merchandise by law, return unopened items to the sender if there is a return address, or dispose of opened items if it is safe to do so.
USPS guidance also warns against contacting the sender. Doing that could confirm your address and lead to more unwanted packages.
If you think the item may have exposed personal information, the Postal Inspection Service says to change passwords and watch credit reports and credit card bills closely.
What not to do
Do not scan a QR code from an item you were not expecting. Do not click unknown links. And do not assume that an ordinary-looking envelope is safe just because it looks plain.
The FBI has also warned that unsolicited packages with QR codes can be used to steal personal data or install malware, according to reporting summarizing the bureau’s alert.
The safest response is simple: treat an unexpected mailer as suspicious until you know where it came from.
