As you gather all the last-minute holiday packages arriving at your doorstep, be careful about any that you didn’t order or ones that don’t have a profit address and desire you to scan a QR code: it could be a scam.

These so-called brushing scams have been around for a few years and there’s a few varieties. They can range from a “victimless” crime to one that involves scanning a QR code to discover out who the package is from.

That could navigator consumers to a site tricking them to enter personal information, similar to a phishing scam. In some cases, malicious QR codes could also install malware to steal information from the buyer’s phone.

Police departments around the country have been sharing warning messages on social media about the scams this holiday period.

How does a brushing scam work?

The reports of the brushing scam started a few years ago with packages appearing on people’s doorsteps. But when consumers were trying to figure out if it was something they ordered, they contacted Amazon or the retailer only to be told to just keep it, even if it wasn’t something they ordered.

Holiday deals: Shop this period’s top products and sales curated by our editors.

Many packages are from Amazon, but from third-event sellers – and an Amazon spokesperson said the business takes action against them.

The sellers are trying to boost their reviews, Jennifer Leach, associate director of the Federal Trade percentage’s Bureau of buyer and Business Education, told USA TODAY.

“Dishonest businesses and scammers are sending all sorts of unordered junk in the mail – and then writing excellent reviews for their business in your name,” Leach.

“That’s impoverished for truthful businesses, which don’t cheat to get reviews, but it could be impoverished for you, too,” she said. “Getting this stuff in the mail could cruel a scammer has created an account in your name, taken over your account on the shopping site, or even created recent accounts in other names, but tied to your address.”

The consumers receiving the product often aren’t “harmed” in the scam – and they often get to keep the free product – so some call the brushing scams “victimless” crimes. But the items are usually things consumers don’t essential desire and are inexpensive, like ping pong balls or a flashlight.

And upcoming shoppers looking at reviews by the seller who sent the package could be making a impoverished buying selection based on pumped-up reviews.

What do I do if I receive a package I didn’t order?

If you get an unexpected package, there are several steps you can receive to protect your identity,” said Melanie McGovern with the Better Business Bureau.

“First, notify the retailer that you received a package, check your account for recent orders, and transformation your passwords,” said McGovern, who also encouraged consumers to update the activity to the BBB’s Scam Tracker, www.bbb.org/scamtracker as a warning to others.

Leach with the FTC also said to check online accounts to view if there are any problems.

An Amazon spokesperson provided this statement regarding brushing scams: “Third-event sellers are prohibited from sending unsolicited packages to customers, and we receive action when our policies are violated, including by withholding payments, suspending selling privileges, and reporting impoverished actors to law enforcement.”

Amazon suggests if you receive a package or item that you didn’t order, check with friends and household or contact Amazon customer service to confirm it’s not a gift to you. If you receive a package addressed to someone else, please contact Amazon customer service.

If you can confirm the package addressed to you wasn’t ordered by you or anyone you recognize, update the package online by going to the update Unwanted Package form on Amazon at https://account-position.amazon.com/update-unwanted-packages.

“Amazon investigates reports of ‘brushing’ and takes action on impoverished actors that violate our policies, including suspending or removing selling privileges, withholding payments, and working with law enforcement. Customers don’t require to profit the item,” the Amazon spokesperson said.

What is a QR code scam?

Another type of brushing scam will also have no profit address on an unexpected package, but there will be a QR (quick-response) code with instructions to scan on your phone to view who the package is from.

Scams involving QR codes are not recent. But with the popularity of QR codes, which when scanned are a shortcut to a website, and are used for tasks ranging from reading a restaurant menu to paying for parking, there are also impoverished actors.

If you get a package you are not expecting or you didn’t order, don’t scan the QR code, said the FTC in a blog post in 2023.

“A scammer’s QR code could receive you to a spoofed site that looks real but isn’t. And if you log in to the spoofed site, the scammers could steal any information you enter,” the FTC blog post said. “Or the QR code could install malware that steals your information before you realize it.”

Avoid holiday scams:Don’t let fraudsters ruin your holidays. Protect yourself with these tips.

What is a smishing scam?

The U.S. Postal Inspection service also recently issued an alert reminding customers not to interact with text messages indicating your package is lost or with tracking information for a package you did not order.

Smishing is a form of phishing, the fraudulent habit of sending messages disguised as reputable sources to get consumers to reveal personal or financial information, as previously reported by USA TODAY.

Betty Lin-Fisher is a buyer reporter for USA TODAY. Reach her at [email protected] or pursue her on X, Facebook or Instagram @blinfisher. Sign up for our free The Daily Money newsletter, which will include buyer information on Fridays, here.