As you gather all the last-minute holiday packages arriving at your doorstep, be careful about any that you didn't order or ones that don't have a return address and want you to scan a QR code: it could be a scam.
These so-called brushing scams have been around for a few years and there's a few varieties. They can range from a "victimless" crime to one that involves scanning a QR code to find out who the package is from.
That could lead consumers to a site tricking them to enter personal information, similar to a phishing scam. In some cases, malicious QR codes could also install malware to steal information from the consumer's phone.
Police departments around the country have been sharing warning messages on social media about the scams this holiday season.
The reports of the brushing scam started a few years ago with packages appearing on people's doorsteps. But when consumers were trying to figure out if it was something they ordered, they contacted Amazon or the retailer only to be told to just keep it, even if it wasn't something they ordered.
Many packages are from Amazon, but from third-party sellers – and an Amazon spokesperson said the company takes action against them.
The sellers are trying to boost their reviews, Jennifer Leach, associate director of the Federal Trade Commission's Bureau of Consumer and Business Education.