THE SCAM
The package you never ordered.
A package shows up at your door that you never ordered. Inside is some cheap item — a skin-care product, a hair tool, a trinket — and it looks like it came from Amazon or eBay. Tucked in with it is a note, a card, or a QR code inviting you to scan, register the product, or visit a website to claim a "free gift."
That's the trap. The site looks legitimate but is built to harvest whatever you type — email, passwords, card details — or the QR code drops malware onto your phone. Federal officials are warning this is a scam called "brushing," and the Better Business Bureau says it's becoming more and more common. The package isn't a gift. It's bait.
THE RED FLAG
Free stuff doesn't come with homework. A real order you actually placed doesn't need you to scan a surprise QR code or register on a strange website to "activate" it. Anything inside a package you didn't order that asks you to click, scan, log in, or enter information is the whole point of the scam.
THE RULE
Keep the item — the FTC says you have every right to keep merchandise you never ordered and you don't have to pay for it or send it back. But don't touch anything it asks you to touch: no QR codes, no links, no "registration" pages. Then check your shopping accounts for anything suspicious and change those passwords, just in case your details are floating around out there.
(Source: KPRC Click2Houston / BBB consumer warning, September 2026)
SIGN-OFF
That's today's red flag. One scam, one red flag, one rule — pass it to someone who clicks first and asks questions later.
Got a scam text or a sketchy email? Send it via the contact page — the best ones make future red flags.