A package arrived a new scam is here

 The following is from The Current, by Kim Komando at Komando.com

Brush with danger

A box shows up on your porch. Your name, your address, no receipt, no sender. Inside: a seed packet, a cheap ring, one sad pasta strainer.

You didn’t order it. So, who did? A scammer, and here’s the kicker: The package isn’t a scam. YOU are the product.

It’s called a brushing scam. Sketchy online sellers need glowing “verified purchase” reviews to climb the rankings. They buy your name and address (data breaches are the gift that keeps on giving), ship you something that costs them pennies, and boom, the system sees a real delivery to a real customer. Then they write a 5-star review of their junk product. Signed, basically, by you.

The U.S. Postal Inspection Service says it plainly: It’s illegal, and if you’re getting these boxes, your personal information is compromised. Not “might be.” Is.

Lately these packages come with a little card: “Scan this QR code to see who sent your gift!” The FBI put out a formal alert about this one. That code can send you to a phishing site that harvests your card number, or it could push malware onto your phone. Curiosity is what they’re counting on.

The package is bait. The QR code is the hook. Don’t be the fish.

✅ Got one? Do this.

Keep it, toss it or donate it. Guilt-free. Federal law says unordered merchandise is yours to keep as a free gift. You owe nobody a dime.

Do NOT scan any QR code or visit any website printed inside. And never pay a “shipping fee” to claim a mystery gift.

Change the password on your Amazon and shopping accounts, and turn on two-factor authentication while you’re in there. If a scammer has your address, assume they’ve shopped for more.

Check your accounts for reviews you didn’t write and orders you didn’t place. Report fakes to the retailer. Amazon has a dedicated brushing report page.

Watch your credit at all three bureaus, plus card statements for small test charges.