Phishing Quishing (QR Code Phishing) Corroborated research/advisory

Brushing 2.0: unsolicited packages with QR codes (FBI, FTC, USPIS, 2025)

In 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or malware. How the brushing 2.0 scam works.

Social Engineering Examples·6 sources

In 2025, the FBI, the FTC and the US Postal Inspection Service each warned about a new twist on "brushing" scams. People received packages they never ordered, often with no sender's name, containing a QR code and a note saying to scan it to find out who sent the gift or how to return it. The code led to a fake website that took personal or financial details, or tried to install malware. Status: Government advisories, no loss figures published.

Key takeaways

The mystery gift creates curiosity. The QR code turns that curiosity into a phishing click.
In the US, unordered goods sent to you are yours to keep. There's nothing to register, return or confirm.
The FBI said this scheme is "not as widespread as other fraud schemes". No agency has published a loss figure or victim count.
It skips email and text filters entirely, because the lure arrives in a box.

What brushing is

Brushing is an old e-commerce trick. A seller ships cheap items to real addresses so it can post fake "verified purchase" reviews in the recipient's name, boosting its ratings. The recipient just gets a strange parcel. The 2025 version, which the USPIS calls a QR-code variation, adds a phishing step: the parcel now asks you to do something.

How the QR version works

Step	What happens
Delivery	A low-value package arrives, often with no sender information
Note	A card with a QR code: scan to see who sent it, to register it, or to return it
Scan	The code opens a fake site posing as a retailer, carrier, bank or agency
Payoff	The site asks for card numbers, logins or personal details, or prompts an app install or permissions that put malware on the phone

This is quishing, QR-code phishing, delivered by post. It's a cousin of the FIN7 USB mailings, which also used a free gift to get people to act.

Tip: an unexpected parcel is a reason to be careful, not curious. Don't scan anything that came in it.

The warnings

Date	Agency	Warning
23 January 2025	FTC	Consumer alert about unexpected packages with QR codes
24 March 2025	USPIS	Brushing scam page updated with the QR variation
31 July 2025	FBI	Public service announcement I-073125-PSA
20 August 2026	FTC	Further consumer alert

None of the advisories names a person or group, and none gives a dollar loss, victim count or number of complaints for this variant. That doesn't mean the loss is zero. It means it hasn't been measured publicly.

What to do

Don't scan QR codes from packages you didn't order.
Keep or bin the item. Under US law, unordered merchandise is yours, with no action needed.
If you scanned and entered details, change passwords, turn on two-factor login, and check your credit report.
Check your phone for apps or permissions added after scanning, and remove them.
Report it to the FBI at IC3.gov, the FTC, or the Postal Inspection Service.

Common questions

What is a brushing scam with a QR code?

You receive a package you didn't order with a QR code inside. Scanning it leads to a fake site that steals your details or installs malware.

Do I have to return an unsolicited package?

No. In the US, unordered merchandise sent to you is yours to keep, and you don't need to contact anyone.

Is the brushing QR scam common?

The FBI said it is not as widespread as other fraud schemes. No agency has published loss figures for it.

What should I do if I scanned the QR code?

Change any passwords you entered, turn on two-factor login, check your phone for new apps or permissions, and watch your accounts and credit report.

Sources

Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes (PSA I-073125-PSA). FBI / Internet Crime Complaint Center (IC3) (primary). Official PSA, published Jul. 31, 2025; states the scheme is a QR-code variant of brushing scams and 'not as widespread as other fraud schemes'; no loss figures given. Fetched and confirmed live 2026-07-29.
Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes. FBI (primary). FBI.gov mirror of the same PSA content. Fetched and confirmed live 2026-07-29.
Scam alert: QR code on an unexpected package. Federal Trade Commission (primary). Published Jan. 23, 2025 by Alvaro Puig, FTC Consumer Education Specialist; describes the scam mechanics and remediation steps. Fetched and confirmed live 2026-07-29.
Quishing. United States Postal Inspection Service (primary). USPIS explainer defining quishing and its brushing-package variant, with reporting instructions (spam@uspis.gov). Fetched and confirmed live 2026-07-29.
Brushing Scam. United States Postal Inspection Service (primary). Published Mar. 24, 2025 (confirmed via independent search of page metadata); details the traditional brushing scam and its 2025 quishing-card evolution, plus protective steps. Fetched and confirmed live 2026-07-29.
That unexpected package you got could be a brushing scam. FTC Consumer Advice (primary). Published Aug. 20, 2026 by BCP Staff; describes brushing packages and warns that enclosed QR codes may lead to phishing sites that steal payment information or credentials. Fetched and confirmed live 2026-10-09.

Cite this case

Social Engineering Examples. “Brushing 2.0: unsolicited packages with QR codes (FBI, FTC, USPIS, 2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/fbi-uspis-ftc-quishing-brushing-package-scam-2025

Attack Chain & Defense

1Address and target sourcing

What happened

USPIS describes the sender as usually an international third-party seller who found the recipient's address online.