The Federal Trade Commission issued a new bulletin warning consumers about brushing scams, which involve receiving packages that were not ordered.

The FTC said the packages can be a sign that personal information has been compromised.

The agency also warned about a newer tactic involving packages that include QR codes with messages such as “scan to return” or “scan to find out who sent the package.”

RELATED STORY | Receive a warning from Facebook about your account? It's likely a scam

The FTC said the QR codes could direct people to phishing websites designed to steal information, including credit card numbers, usernames and passwords.

If you receive a package you did not order, the FTC recommends changing online shopping passwords, reviewing credit card statements, and making sure you are not charged for or required to return the item.

The law also does not require recipients of a package to return it.

RELATED STORY | FTC reports social media scams caused more than $90 million in losses in 2025