THE SCAM A package shows up at your door that you never ordered. Inside is some cheap item — a skin-care product, a hair tool, a trinket — and it looks like it came from Amazon or eBay. Tucked in with it is a note, a card, or a QR code inviting you to scan, register the product, or visit a website to claim a "free gift."

That’s the trap. The site looks legitimate but is built to harvest whatever you type — email, passwords, card details — or the QR code drops malware onto your phone. Federal officials are warning this is a scam called "brushing," and the Better Business Bureau says it’s becoming more and more common. The package isn’t a gift. It’s bait.

THE RED FLAG Free stuff doesn’t come with homework. A real order you actually placed doesn’t need you to scan a surprise QR code or register on a strange website to "activate" it. Anything inside a package you didn’t order that asks you to click, scan, log in, or enter information is the whole point of the scam.

THE RULE Keep the item — the FTC says you have every right to keep merchandise you never ordered and you don’t have to pay for it or send it back. But don’t touch anything it asks you to touch: no QR codes, no links, no "registration" pages. Then check your shopping accounts for anything suspicious and change those passwords, just in case your details are floating around out there.

Read the full entry here: https://erawaeb.com/digest/daily/009-the-package-you-never-ordered/