With Black Friday a little more than a week away, online shopping is about to get a little crazy.

The chaos of this time of year makes it a perfect time for scammers to take advantage.

That’s why the Better Business Bureau (BBB) is sounding the alarm about a sharp rise in so-called “brushing scams.” In these scams, consumers receive unordered packages — often containing QR codes that can expose their personal information or compromise their devices.

Reports of brushing scams have risen 46% in 2025 compared to the previous year, reflecting a troubling escalation in both scale and sophistication, according to BBB spokesperson Melanie McGovern. ​

“As the holiday season approaches, it’s important to keep good records of everything you’ve ordered,” saidMcGovern told TheStreet exclusively. “If you receive a package that you didn’t order, resist the urge to scan any QR code, check your accounts, and report it to BBB’s Scam Tracker.”

A new scam is designed to steal consumers’ personal information.

Shutterstock

How “brushing” scams work in 2025

“Brushing” scams target anyone who shops online and trusts the packages that arrive at their doorstep and in their mailbox.

In other words, just about everyone is vulnerable these days.

In a typical brushing scam, the scammers ship inexpensive products to random addresses, sometimes including QR codes or phony return instructions. The recipient’s identity is then used, without consent, to post fake positive reviews or bolster the sender’s reputation on major platforms, as explained in a BBB announcement from earlier this year.

In 2025, scammers have increasingly attached QR codes to these deliveries.

When scanned, these codes often link to convincing — but fake — order tracking websites or phishing portals that aim to gather sensitive information or install malware on the user’s smartphone, according to Norton, the cybersecurity firm. This method leverages the growing comfort many consumers have with mobile-based transactions and “scan-to-track” conveniences.​

Scams are expensive for consumers and business owners of all sizes

The costs of online shopping scams ultimate hurt everyone, from consumers to independent businesses to massive e-tailers such as Amazon and Walmart.

  • U.S. online retailers lost more than $53.82 billion to fraud in 2024, with most losses occurring domestically (globally, that figure jumps to $138.56 billion).
    Source: CapitalOne Shopping
  • Consumers reported $432 million in direct fraud losses from online shopping scams in 2024, with the median reported loss per incident at $130.
    Source: CapitalOne Shopping
  • Every $100 in fraudulent orders costs U.S. merchants $207, due to chargebacks, fees, and operational disruptions, making the true cost of fraud more than double the actual loss.
    Source: ClickPost
  • For every $1 of fraud, U.S. merchants incur $4.61 in related expenses, including remediation, customer support, and reputation damage.
    Source: LexisNexis Risk Solutions​

What the BBB recommends consumers do to protect themselves

  • Always track every online order, keeping digital or paper records for all purchases and shipments.
  • If an unexpected package arrives — with or without a QR code — do not scan, click, or enter information on any suggested site.​
  • Check major accounts and credit card statements for fraudulent activity.
  • If you suspect a brushing scam, report it immediately to both the retailer and the BBB’s Scam Tracker.
    Source: Better Business Bureau

Real-world example of a holiday brushing scam

In a recent case submitted to the Better Business Bureau’s Scam Tracker, a consumer in the Midwest received a ring from an overseas online store, along with a note containing a QR code and a message to “claim your exclusive customer prize online,” the BBB reported.

Rather than scan the code, the consumer checked their account and notified both their bank and the BBB, helping authorities track the dangerous scam’s origin.

​

“Amazon Prime Day was a goldmine for scammers,” writes McAfee Director for Threat Research and Response Abhishek Karnik about a recent company research report. 

“Text scams in the shopping category jumped 250% from May to late July, with much of that spike happening right around Prime Day. Coincidence? Absolutely not,” he says.

5 common internet scams

Consumers have faced a wide range of online threats; the most significant include:​

  • Romance scams that involve emotional manipulation and financial theft via dating networks.
    Source: Experian ​
  • Crypto investment cons based on “Get rich quick” offerings that vanish overnight.
    Source: Investopedia​
  • Government impersonator frauds claiming to be IRS, Social Security, or law enforcement contacts.
    Source: Experian ​
  • Online purchase and fake marketplace scams involving non-delivery and counterfeit goods.
    Source: Norton ​
  • Fake disaster relief operations that happen after a natural disaster or similar event:
    Source: Kiplinger​

Experts and the BBB agree: Vigilance is key. By maintaining accurate shopping records and reporting any suspicious activity, you’ll protect yourself and others.

BBB and the country’s largest e-commerce business, Amazon, agree that it’s easier than ever to be fooled.

Related: AT&T data breach class action settlement could pay customers $7,500