QR codes nearby without knowing their destinations. In late July 2025, the FBI warned Americans about a new form of fraud that begins with an enigmatic package containing solely a QR code. The FBI advises users against scanning it, as they could become victims of a scam intended to steal personal data, funds, or both.
In January 2025, the Federal Trade Commission (FTC) issued a similar alert regarding surprising packages that included notes with QR codes encouraging recipients to scan them for further details. A month later, the U.S. Postal Service (USPS) put out its own advisory about QR codes found in unsolicited packages. The FBI clarifies that this QR code scam falls under a type of fraud referred to as “brushing scams.” Some online sellers might send unwarranted items to unsuspecting individuals and subsequently utilize that individual’s information to create a review for the product.
The FBI’s alert addresses a variant of brushing where perpetrators embed QR codes in packages to persuade recipients to scan them for additional actions. The QR code could redirect the user to a website asking for personal information or financial data. Additionally, QR codes can be employed to install harmful software on devices to extract information from users, a scam that the USPS refers to as quishing, or QR code phishing.