Facebook posts about the dangers of consumers receiving a package as part of a brushing scam warn that the lone act of scanning a malicious QR code — a code found inside the unsolicited parcel — can immediately compromise a user's phone and personal and financial information, and drain their bank accounts.