It may look like a surprise holiday gift on our porch, but law enforcement in Northern Virginia is warning it could be a scam.

The “brushing scam” begins when a person receives an unexpected package in the mail disguised as a gift, said Ashley Savage, a spokesperson for the Arlington County Police Department.

“It doesn’t have identifying information on it, so when they open it up, there’s a QR code inside, and the individual is encouraged to scan that QR code to find out who sent the package,” Savage said. “Ultimately, it’s a phishing type scam where they’re going to be redirected to a website that’s designed to steal your information.”

While there haven’t been reports of brushing scam incidents in Arlington County, according to Savage, there have been reports elsewhere including in Colorado, Maine and Ohio.

“As a result of that, we just did an update to our overall scams alert to remind individuals of common scams that we’re seeing and also this emerging scam that we’re seeing in other areas of the country,” she said.

Police are reminding people to stay vigilant this holiday season, and watch out for unsolicited texts, emails, calls or packages.

If a call makes you uncomfortable, hang up. Don’t give personal information to someone you don’t know, police advised.

Avoid paying for anything in usual ways, including with Bitcoin or gift cards, check your financial records regularly and report any irregularities to your financial institution and local law enforcement, according to the police department.

Savage asked anyone who has been targeted by a scammer to report it so law enforcement can track incidents and send out community alerts.

“Many scams end up originating from overseas,” Savage said, adding it limits what law enforcement can do. “But that’s why educational campaigns like this are so important so that we’re putting the information in our community’s hands and … that they’re able to avoid and spot these types of scams.”