The label has your name. The box is real. The order never happened. Before you call it a Halloween treat, consider a less friendly explanation: a brushing scam.
A mystery parcel is a perfect little cliffhanger. Who sent it? Is it a gift? And why does the card inside want you to scan something before you can find out?
For shoppers, the lesson is to pause before following the card. For small businesses, it is a reminder that good packaging should protect both the product and the customer’s confidence. Here is how to keep the surprise fun without making the sender a mystery.
What is a brushing scam?
In an August 20, 2026 consumer alert, the FTC describes packages that recipients never ordered. Scammers use delivery as a basis for fake reviews in the recipient’s name. The item may be something cheap and random. The package is real; the supposed customer’s endorsement is not.
The alert also describes a second hook: a QR code promising to identify the sender or handle a return. That code may lead to a phishing website that seeks payment details or account credentials.
That makes this more than a strange freebie. A parcel can become a prop that persuades someone to trust the next instruction. Think of the cardboard as the costume—not proof of who is behind it.
The QR-code twist: a trap wearing a gift costume
The U.S. Postal Inspection Service’s brushing warning calls this QR-code phishing variation quishing. Its guidance describes cards that invite people to scan to learn who sent a gift. The destination can imitate a trusted organization while seeking personal information.
A QR code is a way to open a destination, not a seal of approval. Likewise, a neat insert, familiar-looking logo, or correctly printed address does not verify the sender.
However, an unexpected parcel does not automatically prove fraud. A household member may have ordered it, a friend may have sent a gift, or a retailer may have made a mistake. Start with those checks using contact details you already trust. Do not let the mystery card choose your route.
Suspect a brushing scam? Start here
- Check the basics. Compare the label with your name and address. Ask your household and check your actual order history.
- Skip the mystery QR code. Open the retailer’s known app or website yourself. Contact support there rather than through the package insert.
- Protect your accounts. For suspected brushing, the FTC recommends changing shopping-account passwords, monitoring your credit, and reporting the matter to the marketplace.
- Report the scam. Use the FTC’s fraud-reporting site. Avoid posting a photo of your full shipping label publicly.
The FTC also cautions against using an unknown product simply because it arrived. Meanwhile, USPIS advises contacting appropriate authorities about unknown substances, food, plants, or seeds. Do not taste, plant, or experiment with mystery contents to identify them.
One important distinction: these tips concern unexpected merchandise addressed to you. A neighbor’s name on a misdelivered parcel is a different situation; contact the carrier rather than treating it as your gift.
For sellers: make the unboxing surprising, not suspicious
A brushing scam exploits confusion. Your legitimate Halloween order should not require detective work. For example, a customer can enjoy tissue paper, a seasonal thank-you note, and a little theatrical flair while still knowing exactly which business shipped it.
Next, use these practical checks at your packing bench. They are communication suggestions—not a claim that a particular box or insert prevents fraud.
- Keep the seller identity consistent. Where appropriate, use the same recognizable store name in the order confirmation, packing slip, and customer-support instructions.
- Give the customer a plain-text route. If an insert includes a QR code, explain its purpose and print your official website alongside it. The customer should have another way to reach the same information.
- Remove the pressure. Avoid wording that suggests a customer must scan immediately to claim an unexplained reward or resolve a surprise charge.
- Keep private details inside. Include only the information needed to identify the order. Do not print account credentials or unnecessary customer details on inserts or outer packaging.
For example, a care card might say, “Care instructions are available on our website under Product Care.” A clear destination is more useful than a cryptic “Scan to unlock your surprise.” Also, check any insert against the marketplace’s rules before using it.
Pack a recognizable order without advertising its value
Clear identification does not mean listing valuable contents on the outside. An ordinary outer package and a clear packing slip inside can serve different purposes. Our guide to discreet coin shipping explores that balance for collectible orders.
When a product needs a rigid outer package, compare suitable white corrugated boxes by dimensions and specifications. Compact orders may suit white corrugated mailer boxes, while larger shipments may need white corrugated shipping boxes. Color alone does not establish strength or authenticity.
For appropriate small items, Bubble Mailers offer another format to evaluate. They do not replace a rigid carton when crush protection is necessary. Inside suitable cartons, Bubble Pouches and Bubble out bags can form part of the cushioning plan for compatible products. Check fit, separation, and movement before sealing.
To reduce the confusion a brushing scam relies on, place the packing slip where the customer can find it easily. Finally, keep Halloween decoration away from the shipping label and closure. A clear order reference and a well-protected item are more useful than a box full of unexplained extras.
The one-order Halloween test
Before your next batch ships, ask a colleague to inspect one finished sample as if they were the customer. Can they identify the store? Match the contents to the order? Find a normal route to support without scanning a code?
If not, fix the information before adding more decoration. Next, review the package for physical protection. After all, trust and cushioning solve different problems, and neither replaces the other.
A brushing scam turns curiosity into leverage. A good seller does the opposite: removes confusion and lets the product be the treat. This Halloween, keep the ghosts on the thank-you card—not in the question of who sent the box.
