The scam sometimes arises from third-party sellers trying to get good reviews on Amazon
MYSTERY gifts left on your doorstep might not be a happy Christmas surprise - because some last-minute packages could scam you out of thousands of dollars.
Brushing scams use unexpected Amazon parcels to trick recipients into scanning malicious QR codes to find out who sent the gift.
The packages, often appearing to be sent by Amazon or another popular retailer, can contain seemingly lavish gifts like jewelry or technology.
However, because no return address is indicated anywhere on the package, shoppers are led to scan a QR code that promises to reveal who sent the gift.
The QR codes can lead consumers to a site that leads them to enter personal information.
In some cases, the QR codes could automatically install malware that immediately surrenders all personal information on your phone - including credit card information, which could mean money being drained from your bank accounts.
Confused recipients who opt out of scanning the dangerous QR code typically call Amazon or the retailer who sent the gift - only to be told to keep the package, even if they didn't order it.
While you can hold on to the gift inside the package, officials warn not to fall for the QR code trick.
"A scammer's QR code could take you to a spoofed site that looks real but isn't," the Federal Trade Commission advised last year.
"And if you log in to the spoofed site, the scammers could steal any information you enter. Or the QR code could install malware that steals your information before you realize it."
The FTC encourages recipients to inspect URLs and to never open QR codes from unexpected gifts - especially if it urges you to act immediately.
If you think the message could be legitimate, contact the company via phone number or website.
Amazon says on their site that the company takes action against third-party sellers that send scam packages.
"Amazon investigates reports of 'brushing' and takes action on bad actors that violate our policies, including suspending or removing selling privileges, withholding payments, and working with law enforcement," Amazon said.
"Customers don't need to return the item."
Jennifer Leach, associate director of the FTC's Bureau of Consumer and Business Education, told USA Today that third-party sellers can enact brushing scams to try to boost their reviews on Amazon.
"Dishonest businesses and scammers are sending all sorts of unordered junk in the mail - and then writing good reviews for their business in your name," Leach warned.
"That's bad for honest businesses, which don't cheat to get reviews, but it could be bad for you, too," she said.
"Getting this stuff in the mail could mean a scammer has created an account in your name, taken over your account on the shopping site, or even created new accounts in other names, but tied to your address."
If you receive a package you didn't order or weren't expecting, Amazon encourages recipients to check with friends and family to make sure it's not a surprise.
Then, you can contact customer service to confirm it's not a gift for you.