You arrive home to find an unexpected cardboard box on your porch. It bears the familiar smile logo of Amazon, is addressed to you by name, and contains a tangible item you definitely did not order. Inside the packaging, alongside a cheap gadget or a random household trinket, sits a small card with a QR code and a tempting instruction: “Scan to see who sent this gift” or “Scan for return instructions.”
This scenario is the latest evolution of an online retail fraud known as “brushing,” but criminals have added a digital twist designed to steal far more than just your address. Security experts and consumer protection agencies are warning shoppers that this seemingly innocent curiosity gap is actually a gateway to a scam known as “quishing.”
Understanding the Brushing Phenomenon
At its core, “brushing” is a technique used by unethical third-party sellers to manipulate online rankings. A seller obtains your name and address from public records or data leaks and creates a fake account in your name. They then purchase their own products and ship them to your house. Because a physical delivery is confirmed by the carrier, the seller can write a “verified purchase” review on their own listing using the fake account. These five-star reviews artificially boost the product’s visibility, tricking real customers into buying low-quality goods.
For years, the primary annoyance for the recipient was simply figuring out what to do with unwanted items like phone cases, seeds, or cheap jewelry. However, the scam has mutated into something more malicious.
The QR Code Trap
The newest variation involves the inclusion of a QR code inside the package. Scammers know that human curiosity is powerful. When you receive a mystery package, your first question is almost always, “Who sent this?” The criminals exploit this by including a note that promises to answer that question or offers a way to return the item if you simply scan the code with your smartphone.
This technique is often called “quishing,” or QR code phishing. Because QR codes are just visual representations of website links, they bypass many of the security filters that protect email inboxes. When you scan the code, you are often directed to a fraudulent website that looks remarkably like a legitimate Amazon login page or a customer service portal.
The Risks of Scanning
Once you arrive at the fake landing page, the trap is sprung. The site may ask you to “log in” to view the sender’s details, effectively handing your username and password directly to the scammers. In other versions, the site might request additional personal information to “verify your identity” before processing a return, allowing criminals to harvest your date of birth, credit card number, or social security number.
In the worst-case scenarios, scanning the code can trigger a drive-by download of malware onto your device. This malicious software can run in the background of your phone, logging keystrokes or accessing sensitive banking apps without your knowledge.
What You Should Do
If you receive an unsolicited package, you should treat it with a healthy dose of skepticism. The Federal Trade Commission has clarified that you are legally allowed to keep unordered merchandise sent to your home as a free gift. You are under no obligation to return it or pay for it.
However, you should absolutely avoid scanning any QR codes or visiting any URLs included on inserts within the box. If you are curious about the package’s origin, log in to your Amazon account independently through your web browser or official app to check your order history. If the item does not appear there, do not engage with the package’s paperwork.
Steps for Protection
If you suspect you have already fallen for this trick and scanned a code, immediate action is required. You should change your Amazon password and the passwords for any other accounts that share the same credentials. Enabling two-factor authentication adds a critical layer of defense that can stop scammers even if they have your password. Finally, monitor your bank statements and credit reports closely for any unusual activity.
The “free gift” scam relies on your natural curiosity and politeness. By recognizing the package for what it is—a tool for manipulation and data theft—you can enjoy the free item while keeping your digital identity locked down.
