Security Training
The Package You Did Not Order and the QR Code Inside
What Is Happening
A box arrives with your name on it, but you did not order it. Inside is something small and cheap, plus a card that says to scan a QR code to see who sent it or to start a return.
The FTC calls this a brushing scam and warned about it on August 20, 2026. The QR code is the bigger risk. The FTC says it can lead to a phishing site built to collect card numbers, usernames or passwords.
You cannot read a QR code, so you cannot judge the link until your phone shows it. The same care applies to a QR code in an email, an attached document or a flyer left at the front desk.
Sources
- FTC Consumer Alert, August 20, 2026That Unexpected Package You Got Could Be a Brushing Scam
- FTC Consumer Alert, September 3, 2026See a QR Code Parked Somewhere? Don't Scan It...Yet!
- Microsoft Security Blog, November 5, 2026Email Threat Landscape, Q3 2026 Trends and Insights
Want This for Your Whole Team?Ask us about security awareness training for your staff.
Ask About Awareness Training