An unexpected package can be a real delivery and still be part of a scam. The key question is what the sender wants you to do next. A parcel may be used to generate a fake product review, while a card tucked inside may use a QR code to steer you to a fake website. The safest first move is simple: do not scan a code you were not expecting.
What a mystery package can mean
One possible explanation is a brushing scam. A seller, often an international third-party seller, sends an item you did not order to an address it found online. The package may have no return address or may show a retailer’s name without clearly identifying the seller. The United States Postal Inspection Service describes the purpose as making you appear to be a verified buyer, so the seller can post a positive review in your name and improve the product’s ratings and sales. You received the item, but you did not write the review.
The Postal Inspection Service says brushing is illegal in the United States and many other countries. Receiving an unsolicited package does not by itself mean you ordered anything or did something wrong. The concern is how your name and address may be used, and what the sender may be trying to get you to do next. The available sources give no dollar estimate for the item or any resulting loss. The risk is better understood as a privacy and identity concern than as a known price tag. The Postal Inspection Service explains brushing scams.
How a card can turn a package into a phishing attempt
Some packages include a card with a QR code. A QR code is the square pattern a phone camera can read to open a website or other content. When criminals use one to direct people to a fake site, the tactic is called quishing, short for QR code phishing. The code may promise to identify the sender, explain how to start a return, or help you register a gift. Those instructions can make scanning feel like a practical next step.
But the destination can be a spoof site, meaning a page designed to look like a legitimate retailer, bank, government agency, or other company. The Better Business Bureau describes a version in which scammers arrange for an item, such as pasta, to be shipped in someone’s name through a major retailer’s account, then include a code leading to a site that resembles the retailer’s. A familiar logo or retailer name on a package does not prove that the QR code is safe. The BBB’s warning about QR codes on unexpected packages describes this kind of setup.
Scanning can lead to a phishing site that asks for personal or financial details, or to a download of malicious software, often called malware. A message urging you to scan right away adds pressure, but urgency does not verify the sender. The Postal Inspection Service describes quishing and warns that unexpected QR codes can be used to collect information. Its quishing guidance explains why the code itself deserves caution.
What scammers may be trying to collect
A fake page may ask for account usernames and passwords, your Social Security number, date of birth, credit or debit card numbers, a PIN, or other sensitive information. These requests can be presented as part of a return, gift registration, or package lookup. The explanation may sound routine, but a request for personal or financial details after scanning an unexpected code is a major warning sign.
The Postal Inspection Service treats quishing as identity fraud. Information gathered this way may be used in other crimes, including financial fraud. A website that looks official is not proof that it is official. The relevant detail is how you got there: if an unexpected package sent you to the page through a QR code, do not enter information just because the page uses familiar colors, logos, or wording.
“These ‘free’ items may come with a higher cost than you realize.” The Postal Inspection Service uses that warning without assigning a dollar amount. The practical concern is what a sender may gain from your information or identity.
Red flags and questions to ask before acting
Look at the whole chain of events, not just the shipping label. An unexpected item with no return address, a retailer’s name but no clear sender, or a card with a QR code all call for caution. So does a message that says to scan immediately, or a website reached by scanning that asks for information. A legitimate retailer’s name on the box is not enough to confirm who arranged the shipment. Scammers may use a retailer’s account to send a package.
Before doing anything, ask yourself: Did I order or request this item? Where did the QR code come from, and who sent it? Does the return address identify a seller or store I actually used? If you cannot answer those questions, do not use the code to investigate. Check through a contact method you find independently, rather than following a link or code printed in the package.
What to do if you receive one
Do not scan the QR code. That is the clearest first step in the Postal Inspection Service and BBB guidance. If the package appears connected to the U.S. Postal Service or the QR code is part of a USPS-related quishing attempt, the Postal Inspection Service says to report it by emailing [email protected].
The BBB also advises people who receive an unordered package to take steps to protect their identity and report the scam. The source material available for this article does not provide the full list of those protective steps or detailed reporting instructions. It also does not establish whether an unordered item should be kept, returned, or disposed of. If you need an answer to either question, check current guidance from the relevant official consumer-protection source rather than guessing from the package insert.
If you already scanned the code or entered information, the available guidance here does not spell out steps such as reviewing credit reports or placing a fraud alert or credit freeze. Those options depend on what information was shared and on individual circumstances. Consult current official consumer resources, and consider speaking with a qualified professional if you need help deciding what applies to you. Do not return to the page through the QR code to look for help. A package can be a clue, but the sender’s instructions are not a reliable way to verify what happened.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
