A brushing scam QR code is a code printed on or tucked inside a parcel you never ordered, and the safe answer is simple: do not scan it. A report published on 29 October 2026 by KY3, a television station in Springfield, Missouri, shows why that advice matters, and why businesses that ship products with their own QR codes should think about how their codes look to a suspicious customer.
What was reported in Springfield
According to KY3's On Your Side report, a 75-year-old Springfield resident, identified only as Clara, says she has been receiving packages she did not order since September. The report says the items have included cutlery from TikTok Shop, and that one parcel carried no name at all. She told the station that the odd contents made her realise something was wrong. KY3 says it is working with TikTok to have her address removed from its database.
Experts quoted in the story say deliveries like this can be part of a "brushing scam", in which sellers send unsolicited merchandise to make it look as if verified customers bought and reviewed a product, which can lift ratings and sales. The article adds that the scam may have a new twist: "quishing", meaning phishing through QR codes, where a code in or on the package leads to a fake website designed to steal personal information. James E. Lee, president of the Identity Theft Resource Center, is quoted saying such a code can add malware to a computer or give criminals access to accounts.
It is worth being precise about what the report does and does not say. It describes a woman receiving unwanted parcels and experts warning that a QR code could be the next step. It does not report a specific malicious code found in her packages, and it gives no figures for losses or victims. Treat the QR element as a reported warning, not a confirmed attack in this case.
Why a brushing scam QR code is a different kind of risk
Most QR scams we have written about involve a sticker placed over a genuine code, such as the cases in our posts on parking meters and a trail sign in Iceland. Those scams borrow trust from a real place. A brushing parcel works the other way round: the recipient has no relationship with the sender, so there is nothing to borrow, and the scam relies on curiosity. A card that says "scan to claim your gift" or "scan to leave a review" gives a reason to act on a package that arrived for no reason.
That is the whole mechanism, and it is why the safest habit is also the dullest one. A QR code is only a way of writing a web address. If you cannot say who printed it, you cannot say where it goes, and a professional-looking landing page proves nothing. Our guide to whether QR codes are safe covers how to check a destination before you tap through.
What to do if an unexpected package arrives
The KY3 report lists steps that match standard consumer guidance:
- Do not scan any QR code or click any link included with the package, and do not call phone numbers supplied by the sender.
- Report the parcel to the retailer, the delivery service or the postal service, and follow the carrier's instructions for unwanted merchandise.
- Check your credit report and financial accounts for signs of identity theft.
- If you think your details were exposed, change your passwords and turn on multi-factor authentication.
- In the United States, complaints can be filed with the FTC at reportfraud.ftc.gov, a resource the report names.
What a QR platform cannot fix here
We make one of the tools this topic touches, so here is the limit stated plainly. A scammer who prints a code on a card in a parcel does not need any platform, and no platform can reach into a stranger's package and disable it. A dynamic QR code service, ours included, protects only the codes that you created. It cannot recall a printed card, remove a sticker, or stop someone generating a lookalike with a free tool.
It also cannot make a recipient trust your code. If your customers have been trained by news stories like this one to distrust every code in a box, a genuine code has to earn its scan.
What honest brands can do with their own package codes
If you ship products with a QR code on the box or an insert, whether for setup help, a warranty page, a reorder link or a review request, the Springfield story is a reminder that your customers are being asked to scan a lot of doubtful things. A few practical steps help, and a dynamic code makes several of them cheap. Our pages on QR codes for product packaging and QR codes for marketing campaigns cover the basics, and the pillar guide on QR codes in marketing campaigns explains the wider picture.
Tell people where the code goes
Print a plain-language line next to the code, such as "Opens the setup guide on our website". A code with no explanation looks the same as a scam code. This costs nothing and works with any generator.
Use an address that looks like yours
On the Pro plan you can serve your codes from your own domain, so the address a phone shows before opening matches your brand instead of a generic short link. Our guide to using a custom domain for QR codes explains the setup. This does not stop impersonation, but it gives careful customers something to check.
Watch what your codes actually do
Each dynamic code keeps a scan log with country, city and device, and the QR code tracking tools let you export it as CSV on paid plans. A sudden burst of scans from a country you do not ship to is a prompt to look closer. Our bot filtering separates link-preview crawlers from people, so the numbers you read are closer to real scans. On Pro, scan alerts and webhooks can tell you when something unusual happens instead of waiting for you to look.
Be able to switch a code off or move it in seconds
If a printed code is ever misused, for example because a destination page is compromised or a campaign ends, you can pause the code or re-point it, and the change applies to every printed copy within seconds. You can also set an expiry date, a password or a country restriction per code. Codes have no expiry unless you set one, and free-plan codes stay live. For background, see what a dynamic QR code is and our dynamic QR code generator.
The takeaway for shoppers and shippers
For shoppers, the rule from Springfield is to treat any code inside a parcel you did not order as untrusted, report the parcel and keep your accounts under watch. For shippers, the lesson is that trust is now part of your packaging: explain the code, make the address recognisable, and keep the ability to monitor and switch off what you printed. None of that stops a criminal's cards, but it does make your own codes safer to use and faster to fix.
Source: KY3, "On Your Side: Springfield woman warns about unwanted packages, QR codes could lead to scams", 29 October 2026.