New wave of \u201cquisling\u201d turns surprise deliveries into phishing traps. The FBI\u2019s message is simple: don\u2019t scan codes you didn\u2019t request.<\/p>\n\n\n\n
QR codes are everywhere\u2014from restaurant menus to real estate signs\u2014but not on mystery boxes at your door. Some packages arrive with printed codes that link to fake portals or download malicious software. Who\u2019s at risk? Anyone who scans before thinking.<\/p>\n\n\n\n
Brushing happens when a seller sends you an unsolicited item, then posts a fake review in your name to boost sales. An unexpected package is a red flag that your address\u2014and possibly other info\u2014was misused.<\/p>\n\n\n\n
Quishing is the new twist. The box displays a QR code; scanning prompts you to enter personal or payment details, or silently installs malware. Many boxes lack sender information, nudging you to scan \u201cto learn more.\u201d Got a package you didn\u2019t order? Here\u2019s a quick comparison to help you spot the difference:<\/p>\n\n\n\n Both schemes rely on curiosity and urgency\u2014two reasons to pause before you scan.<\/p>\n\n\n\n The FBI urges caution with any code you didn\u2019t request. When in doubt, skip the scan and move on.<\/p>\n\n\n\n FBI tips to protect yourself<\/strong><\/p>\n\n\n\nScam type<\/th> How it works<\/th> Main risk<\/th> Typical red flags<\/th><\/tr><\/thead> Brushing<\/td> Unsolicited item; seller posts fake review using your name<\/td> Identity misuse and privacy exposure<\/td> Package you didn\u2019t order; missing or vague sender details<\/td><\/tr> Quishing<\/td> Unsolicited package includes a QR code that leads to phishing or malware<\/td> Account takeover or data theft<\/td> Code urges immediate action, payment, or login to \u201cverify\u201d<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Practical FBI-backed steps to stay safe when unexpected packages arrive<\/h2>\n\n\n\n