Accessibility links

Facebook   X   LinkedIn   Email

New and Improved Brushing Scam Warning

By: Jim Stickley and Tina Davis
May 12, 2026

There’s something oddly satisfying about receiving a package. It can be a very nice surprise creating excitement about what may be inside. But then, you realize you didn’t order it. The FBI, USPS, and other agencies are warning about this QR Code scam.

Enter the latest, new and improved evolution of a familiar con: the QR brushing scam. Traditionally, brushing scams involved unsolicited packages sent to inflate fake online reviews. You’ve probably read about receiving Amazon packages you didn’t order, but are addressed to you. Now, scammers are adding a digital hook. Inside the box, alongside the mystery item, is a QR code urging you to scan for more information, claim a prize, or identify the sender.

The FBI warns that scanning these codes can direct you to malicious websites designed to harvest login credentials, financial details, or install malware on your device. Think of it as phishing, but with a physical breadcrumb trail leading you straight to the trap.

The danger here is subtlety and perhaps a bit of complacency. QR codes have become part of everyday life, used for menus, payments, and promotions. We don’t put so much thought into them anymore. That familiarity lowers our guard. Unlike suspicious links in emails, a printed code feels oddly trustworthy. Attackers are counting on that split-second assumption.

Once scanned, victims may land on convincing pages that mimic legitimate brands or prompt them to enter sensitive information. In some cases, the code can trigger downloads or exploit vulnerabilities without much user interaction.

Avoiding this scam is refreshingly low-tech. If you didn’t order the package, don’t engage with anything inside it, especially QR codes. Resist the urge to “just see what it is.” If curiosity wins, manually search for the company instead of scanning. And as always, keep your device updated and protected with reputable security software.

Sometimes, the most dangerous link isn’t in your inbox. It’s sitting quietly in a box on your porch, waiting to be scanned.



Keep Track Of Common UPS Scams

Scams & Phishing

Keep Track Of Common UPS Scams

With the popularity of online shopping, we all are getting packages delivered to our doors. While perusing the UPS website for important tracking information on a package I was expecting, I noticed there is an entire web page devoted to combatting fraud with regard to the shipment of UPS packages. We're sharing them with you too, as these types of scams are happening more and more these days, and with the impending holiday shopping season nearly upon us, they will most definitely increase in volume. READ FULL STORY
Invoice Phishing’s Hidden Agenda

Scams & Phishing

Invoice Phishing’s Hidden Agenda

There’s a not-so-new cybercrime hitting inboxes everywhere and it’s using phishing invoices to install a variety of malware, including an info-stealer. While some of us regularly get invoices in our inbox for this or that, we should all be aware of this invoice-themed phishing attack that’s likely to show up to collect payment in your email soon. This invoice phishing attack, like most others, takes advantage of something we cannot avoid: Being human. READ FULL STORY
What Is A Brushing Scam?

Scams & Phishing

What Is A Brushing Scam?

We haven’t talked about brushing scams much of late. However, there is one happening now that is significant enough that the FBI’s IC3 unit issued a warning about it. It involves mystery packages being delivered to your home with no information about where they came from and though many are harmless, some make that bargain you thought you were getting vastly more expensive. And to make it easier for you to fall for the scam, a convenient QR code is inside so you can solve the mystery easily and deliver your money to the scammers too. READ FULL STORY
FBI Warns Medusa is Trying to Snake Her Way Into Your Network

Your Security

FBI Warns Medusa is Trying to Snake Her Way Into Your Network

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) recently issued a warning about a ransomware-as-a-service variant that has been on the attack since December. The Medusa ransomware, a sophisticated cyber threat that has targeted over 300 victims across critical infrastructure sectors. These include, healthcare, education, and manufacturing. The group employs tactics such as phishing campaigns and exploiting unpatched software vulnerabilities to gain unauthorized access to systems. READ FULL STORY
Holiday or Not, These Scams Ignore Holiday Spirit

Scams & Phishing

Holiday or Not, These Scams Ignore Holiday Spirit

As the holiday season ramps up, so do scams—but make no mistake, these schemes run year-round. Cybercriminals simply turn up the volume when people are shopping more, traveling, and feeling generous. Four scams in particular continue to trap victims every month of the year, with a noticeable spike during holidays and major shopping seasons. And for good reason. We’re out and about, likely shopping more than normal, and in the giving spirit.  READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.