You Got a Package You Didn’t Order? Here’s What a Brushing Scam Actually Means (2026)
Quick answer: A random package showing up with your name and address on it, containing something cheap like seeds or phone accessories, is almost always a “brushing” scam — a seller using your identity to fake a verified purchase and post a glowing review in your name. The FTC confirmed this warning again on August 17, 2026. You do not have to pay for it or return it, but you should change your online shopping passwords and check your account activity, since the scam usually means your name and address leaked somewhere.
A box shows up. You didn’t order it. Inside is something small and cheap — a phone case, some seeds, a set of socks — and there’s no return address that makes any sense. The FTC reissued its brushing scam warning on August 17, 2026, and the mechanics haven’t changed: a third-party seller ships you something at random so they can log a “verified purchase” and post a fake five-star review under your name.
The package itself is the least concerning part. What matters more is how the seller got your name and shipping address in the first place, and whether that same data leak touched anything more sensitive than your mailing address.
📌 Related reading: unwanted packages aren’t the only place online marketplaces get messy — see our breakdown of Amazon’s Return Window Isn’t Always 30 Days for what happens when you actually did order something and need it back.
What to Do First
- What Is a Brushing Scam, Exactly?
- Why Would a Scammer Send Me Something I Didn’t Order?
- Do You Have to Pay for or Return an Unsolicited Package?
- How Do You Actually Report a Brushing Scam?
- Is the QR Code on the Package Safe to Scan?
What Is a Brushing Scam, Exactly?
A brushing scam is when a third-party seller ships an unordered, low-cost item to a real name and address they found somewhere online, then uses that delivery as fake proof of purchase to post a five-star review under the recipient’s identity.
According to the FTC’s consumer alert updated August 17, 2026, the packages people report usually contain small, inexpensive items — things like baby wipes, seeds, phone accessories, or costume jewelry. The item itself is never the point; it exists purely to generate a shipping record the seller can point to as evidence of a real, verified sale.
Why Would a Scammer Send Me Something I Didn’t Order?
Marketplace platforms weight reviews from verified purchases far more heavily than unverified ones, so a seller with a shipping confirmation can post a review that ranking algorithms treat as trustworthy, even though the “buyer” never chose the product.
When I checked the FTC’s own explanation against how these sellers actually operate, the pattern is consistent: names and addresses get pulled from data broker lists, old shipping records, or breached databases, not typed in by a real customer. If you’ve never bought anything from the brand on the box, that’s expected — you were never meant to be a real customer in the first place.
This part trips people up: the review posted under your name usually isn’t visible to you at all, since it’s attached to a seller account you never created and a review section you have no login for. You can go months without ever knowing your name was used this way unless you go digging for the specific product on the marketplace it came from.
Do You Have to Pay for or Return an Unsolicited Package?
No. Federal law is explicit that you never have to pay for or return merchandise you never ordered, and you’re legally allowed to keep it, throw it away, or donate it.
| Situation | What You’re Required to Do |
|---|---|
| Package with no order history, random item | Nothing. Keep, discard, or donate it freely. |
| Invoice or bill arrives after the package | Nothing. You cannot be legally billed for unordered goods. |
| Seller emails demanding return or payment | Ignore it and report the message as a scam attempt. |
| Package actually matches something you forgot ordering | Check your own order history and card statements before assuming brushing. |
That last row matters more than people expect. Before treating a surprise package as brushing, cross-check it against your recent orders and any gifts friends or family might have sent — misdelivered real orders get mistaken for brushing scams fairly often.
How Do You Actually Report a Brushing Scam?
Report the package to the FTC at ReportFraud.ftc.gov first, since that report feeds directly into the data the agency uses to track and act on brushing patterns.
- Change the password on every shopping account tied to the address the package arrived at.
- Check recent card and bank statements for charges you don’t recognize, even small ones.
- Report the specific package through the marketplace it appears to come from, if you can identify one.
- File a report at ReportFraud.ftc.gov with the seller name, item, and delivery date.
- Skip any QR code, phone number, or link printed on the package itself when reporting — use the platform’s own official app or site instead.
I found that the FTC’s own guidance treats a brushing package as a signal to audit your accounts, not just discard the box and move on. The package is often the only visible evidence that your information is circulating somewhere it shouldn’t be.
Marketplaces themselves also want these reports, separate from the FTC filing. A brushing seller violates nearly every major platform’s terms of service, and enough reports against the same account can get it suspended. Reporting through both the government channel and the marketplace itself covers different outcomes — one builds a fraud pattern record, the other can get the specific bad actor removed.
Is the QR Code on the Package Safe to Scan?
No — the FTC specifically warns against scanning QR codes printed on unsolicited packages, even ones labeled “scan to find your delivery details” or “scan to return.”
Those codes can route straight to phishing pages built to harvest your name, address, and payment details under the guise of a return or tracking form. A legitimate delivery never needs a QR code to identify who sent it; if you want to know the sender, check the shipping label and the marketplace’s own order history instead of a code printed inside the box.
Quick Checklist for an Unsolicited Package
- ✅ Confirm it isn’t a real order you forgot about or a gift from someone you know.
- ✅ Do not scan any QR code printed on the box or packing slip.
- ✅ Change passwords on shopping accounts linked to that delivery address.
- ✅ Report it at ReportFraud.ftc.gov with the seller name and delivery date.
- ✅ Watch your card statements for a few weeks afterward, just in case.
What’s the Real Risk If You Just Ignore It?
Ignoring the package itself is fine — you have no legal obligation regarding the item. The risk isn’t the box; it’s skipping the account and password check that should follow it.
A brushing package means your name and shipping address are being used by a seller you never interacted with, which is a mild but real sign that data about you is more exposed than you assumed. That’s rarely catastrophic on its own, but it’s exactly the kind of low-grade exposure that precedes more targeted phishing later, especially if the same data broker list gets resold.
You’ll probably notice these packages cluster — getting two or three within a short window from different sellers is common once your address enters one of these lists, so a single incident is worth a quick account check, and a repeat pattern is worth taking more seriously.
FAQ
Do I have to pay for a package I never ordered?
No. Federal law says you never have to pay for or return merchandise you did not order, regardless of any invoice or demand that arrives afterward.
Should I scan the QR code on the package?
No. The FTC warns that QR codes on unsolicited packages can lead to phishing pages designed to steal your name, address, and payment information.
Where do I report a brushing scam?
Report it at ReportFraud.ftc.gov with the seller name, the item, and the delivery date, and separately report the package through the marketplace it appears to be linked to if you can identify one.
Sources
- FTC Consumer Advice: That Unexpected Package You Got Could Be a Brushing Scam
- FTC Consumer Advice: Scams
- NBC26: Received a Package You Didn’t Order? FTC Says It Could Be a Scam
Fact-checked based on public FTC sources as of August 22, 2026.
