I received a package I didn't order with a QR code inside — what is it?

It's a scam tactic in one of two known forms: “brushing,” where a seller ships cheap goods to your address so it can post a fake verified review in your name, and “quishing,” where the QR code inside leads to a phishing or malware site. Either way, the real takeaway is that your name and address are circulating among scammers. Don't scan the code, report the package to the marketplace it claims to come from, and keep an eye on your accounts.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — August 12, 2026 →