Unexpected gifts showing up on your doorstep may feel exciting — until you notice the flyer inside urging you to “scan here!” to see who sent it. That QR code won’t reveal a secret admirer; it will take you to a phishing website. This growing scam is called “quishing,” or QR-code phishing. Cute name, dangerous outcome.

According to the USPS, scammers are also sending out “brushing” packages — items addressed to you that you never ordered. They use your name to post fake positive reviews, boosting their product rankings. By law, any unsolicited merchandise is yours to keep. You don’t have to return it or pay for it.

But the real threat comes when these packages include a QR code. Scanning it can send you straight to a quishing site designed to trick you into handing over personal information.

Have a mail scam to report?
Click here to let the USPS know.