You come home and find a package on your doorstep. Your name is on the label, the address is right — but you never ordered anything. Inside is something cheap and random: toothpaste, baby wipes, a packet of seeds, a small trinket. You have no idea who sent it, and the box has no clear sender. It might feel like a harmless mistake or even a small gift. According to the Federal Trade Commission, it could be a brushing scam — and it may be a sign that someone has your personal information.
Brushing gets its name from the practice of “brushing up” a seller’s sales numbers and ratings. Third-party online sellers — often operating from overseas — send inexpensive items to random addresses to create a paper trail of completed deliveries. That delivery record then lets them post glowing “verified purchase” reviews under the recipient’s name, making their products look far more popular and trustworthy than they really are. Shoppers who rely on those reviews end up buying from a seller they would never have trusted otherwise.
For years, brushing looked like a mostly victimless annoyance: you got a free item, the seller got fake reviews. But the FTC issued a fresh consumer alert on brushing in August 2026 because the scam has grown teeth. Some brushing packages now include a note with a QR code that says “scan to find out who sent this” or “scan to process a return.” Scanning it can take you to a phishing site designed to steal your credit card numbers, usernames, and passwords — or silently install malware on your phone. A free package is no longer just strange. It is worth investigating carefully.
How a Brushing Scam Works: Step by Step
Understanding the mechanics makes the whole scheme much easier to recognize:
Step 1: Your address is obtained. The seller finds your name and mailing address somewhere online — a public database, a data breach, a shady marketing list. The U.S. Postal Inspection Service warns that these senders are often international third-party sellers who have found the recipient’s address online, and that your personal information “may be compromised” even if the package itself seems harmless.
Step 2: A cheap item ships to you. The seller mails an inexpensive product to your address. Recent FTC reports say the contents are usually something cheap and random — baby wipes, toothpaste, seeds. In other waves, recipients have gotten jewelry, beauty products, Bluetooth speakers, or packets of unmarked seeds that agricultural authorities have specifically warned people not to plant.
Step 3: The delivery creates “validation.” Once the carrier marks the package as delivered, the seller has a tracking record proving a real delivery to a real person. That record is the fuel for everything that follows.
Step 4: Fake reviews go up in your name. Using the delivery confirmation, the seller posts positive reviews that appear to come from verified buyers — potentially under your name. Those reviews “brush up” the product’s rating, push it higher in marketplace search results, and convince real shoppers to buy. Marketplace algorithms reward products with more reviews and higher ratings, so the fraud compounds.
Step 5 (the dangerous variant): the QR code note. Some packages now include a card or note with a QR code and a tempting instruction — find out who sent the package, claim a bigger gift, or process a return. Scanning it routes you to a phishing website built to harvest your login credentials and payment details, or to a page that downloads malware onto your device. The Better Business Bureau has warned specifically about this brushing-plus-phishing combination.
Why Brushing Is a Bigger Deal Than a Free Gift
It is tempting to shrug: you got something free, nobody lost money, end of story. Regulators disagree, and their reasoning is worth hearing. First, an unsolicited package means someone has your name and home address — and you have no idea how they got it or what else they have. If your address leaked from a compromised account, your payment information may be sitting in the same database. That is why the FTC’s advice focuses on password changes and credit monitoring, not the package itself.
Second, reviews in your name are written without your knowledge or consent. You are being used as an unwitting endorser for products you never bought, and in some cases your name becomes attached to fraudulent storefronts that later scam other shoppers. Third, the QR-code phishing variant is outright identity theft machinery. A single scan can hand over the login credentials that protect your bank accounts, email, and payment apps.
There is also a secondary pattern worth knowing: scammers sometimes send a small unsolicited item and then follow up with a demand for payment, claiming you agreed to a subscription or owe return shipping. This is a separate but related fraud. Know your rights — federal law says you do not have to pay for merchandise you did not order, and you do not have to return it.
Red Flags of a Brushing Scam
Not every surprise package is a scam — it could be a genuine gift from someone forgetful. But these signs point toward brushing:
- You ordered nothing and recognize nothing. The package contains an item you never bought, and it does not match anything on your recent order history.
- The item is cheap and random. Toothpaste, wipes, seeds, costume jewelry, a single phone case — items that look chosen for low cost rather than for you.
- There is no real sender. The return address is missing, vague, or traces to a name you have never heard of. Many brushing packages arrive with no usable return information at all.
- A QR code or link invites you to scan. Any note saying “scan to find out who sent this,” “scan to process a return,” or “scan for a bigger gift” is a serious red flag. Legitimate senders identify themselves on the package.
- Unsolicited seeds. Packets of unidentified seeds arriving from unknown senders have been a recurring brushing pattern; plant-safety officials warn not to plant them because they could introduce invasive species or plant diseases.
- A payment or return-shipping demand follows. If someone contacts you afterward demanding money for the item or for return shipping, you are looking at a separate fraud built on top of the unsolicited shipment.
- Online reviews appear in your name. If you search your name and find reviews for products you never bought, your identity is being used for exactly this scheme.
How to Verify and Protect Yourself: 8 Steps
- Check your order history first. Log in to your accounts at Amazon, Walmart, eBay, Temu, or wherever you shop and confirm the package was not ordered from your account. If you see purchases you did not make, your account itself is compromised — change the password immediately and contact the retailer.
- Change your shopping passwords. Even if your order history is clean, the FTC recommends changing passwords on all your online shopping accounts, because the sender may have obtained your details from a breach.
- Do not scan the QR code or click any link. No matter how curious you are, do not scan codes printed on the package or any included card, and do not type in URLs or call phone numbers printed inside. If the package appears to come from a known company, go to that company’s official website or app on your own and investigate from there.
- Do not contact the sender. The FTC specifically warns against reaching out to an unknown sender: anyone who responds will likely try to extract more of your personal information to steal your money.
- Check your credit. You can pull your credit reports for free at AnnualCreditReport.com. Look for accounts you did not open, hard inquiries you did not authorize, or other signs of identity theft. Consider placing a fraud alert or a credit freeze if anything looks wrong.
- Review your bank and card statements. Look for small unfamiliar charges — scammers sometimes test stolen card numbers with tiny transactions before attempting bigger ones.
- Search for fake reviews in your name. If reviews appear under your name for products you never bought, report them to the marketplace so they can be removed, and tell the platform the seller may be engaged in brushing.
- Report the package to the marketplace. If the box appears to be from Amazon or another platform, use that platform’s reporting tool (Amazon has a “Report Unsolicited Packages” option) so it can investigate and remove the seller.
What to Do If You Got a Mystery Package
Do not panic — but do treat it as a possible warning light. First, set the package aside without scanning anything or opening any links. Verify your shopping accounts and change your passwords as described above. You are under no legal obligation to return or pay for merchandise you did not order, and the FTC says you can keep it, throw it away, or donate it — though it is wise to be cautious about actually using a product from an unknown sender. If the package contained unsolicited seeds, do not plant them; your state’s department of agriculture typically asks to be notified. If you scanned a QR code or entered information on a linked site before realizing what it was, treat the situation as a possible phishing compromise: change the passwords for any accounts whose credentials you entered, enable two-factor authentication, and monitor your statements closely.
How to Report a Brushing Scam
- FTC: Report at ReportFraud.ftc.gov. The FTC uses consumer reports to spot patterns and target enforcement.
- FBI Internet Crime Complaint Center: File a complaint at ic3.gov, especially if a QR code led to phishing or malware.
- U.S. Postal Inspection Service: Brushing packages sent through the mail can be reported as mail fraud through the Postal Inspection Service’s online complaint form at uspis.gov.
- The marketplace: Report unsolicited packages and fake reviews directly to the platform (Amazon, eBay, Walmart, and others all have reporting channels) so the seller’s account can be investigated.
The Bottom Line on Brushing Scams
A brushing scam starts with a package you never ordered and ends — for the scammer — with fake reviews that trick other shoppers, or worse, with your stolen credentials. The package itself is usually harmless; the information trail behind it is not. Do not scan the QR code, do not contact the sender, change your passwords, check your credit, and report what happened. A mystery box on your porch deserves a mystery-free investigation.
Sources
- U.S. Federal Trade Commission, Consumer Advice, “That unexpected package you got could be a brushing scam” (August 2026) — https://consumer.ftc.gov/consumer-alerts/2026/08/unexpected-package-you-got-could-be-brushing-scam
- U.S. Federal Trade Commission, Consumer Advice, “Got a package you didn’t order? It’s probably a scam” (January 2025) — https://consumer.ftc.gov/consumer-alerts/2025/01/got-package-you-didnt-order-its-probably-scam?fbclid=IwZXh0bgNhZW0BMABhZGlkAasWnzUsqO8BHQZEKcTIuc5TsZ85JcnjqSFhkTaJBMcEsBGTU6eFoOKP9K5a5qoIPay4hA_aem_IQyV8TOB4CaGquoQvNdplA
- Detroit Free Press / Susan Tompor, “Veterans warned of phony postcards promising big savings and odd boxes” (September 2026) — https://www.freep.com/story/money/personal-finance/susan-tompor/2026/09/08/brushing-scam-veterans-benefits/91547714007/
- Military Officers Association of America, “Mistaken Delivery, or a ‘Brushing Scam’?” (2026) — https://www.moaa.org/content/publications-and-media/news-articles/2026-news-articles/finance/mistaken-delivery,-or-a-brushing-scam/
- WVLT (Gray Media Group), “Couple’s experience highlights growing brushing scam targeting consumers nationwide” (May 2026) — https://www.wvlt.tv/2026/05/14/couples-experience-highlights-growing-brushing-scam-targeting-consumers-nationwide/
- KPRC / Click2Houston, “Brushing scam warning: What to do if you receive a package you never ordered” (September 2026) — https://gmg-kprc-prod.cdn.arcpublishing.com/news/local/2026/09/15/brushing-scam-warning-what-to-do-if-you-receive-a-package-you-never-ordered/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.