Brushing scams: why you got a package you never ordered
Key Takeaways
- A brushing scam is when a seller ships you something you didn't order, then uses your name to post a fake review.
- You can keep the package. You don't have to pay for it or send it back.
- Don't scan a QR code that comes with the package, and don't contact the sender.
- A brushing package can mean someone has your name and address, so change passwords on shopping accounts and check the credit reports.
- Report it to the FTC and to the marketplace the package came through.
What is a brushing scam?
The Federal Trade Commission (FTC) describes a brushing scam as a package that arrives even though you never ordered it. It can look like it came from a known company, such as Amazon, or from a sender you don't recognize. Most contain something cheap and random, like baby wipes, toothpaste, or seeds.
The package is addressed to you, and that's the point. The sender needs your name and address to make the scam work.
Why did a stranger send me a package?
Brushing is about reviews, not about you. According to the FTC, scammers send these packages to get proof of delivery, then use your name to leave fake online reviews that "brush up" their sales. The Better Business Bureau (BBB) adds that the review often shows as a verified purchase, which makes the seller look more trustworthy to real shoppers.
The items are cheap on purpose, because the review is what the seller wants.
What does a brushing package say about my personal data?
It says someone has your name and address. The FTC notes that senders find that information online, and the BBB says unordered packages may be a sign that personal information has been compromised. A brushing package doesn't prove a breach, and the BBB doesn't claim it does. It's still a good reason to check what's out there.
If your name and address are listed on people-search sites, they're easy for anyone to find. Our guide to removing personal information from people-search sites walks through the steps.
It also helps to know when your details show up in a data leak. Guardio scans the dark web for your email address and phone number, and alerts you the moment they turn up in a data leak, so you can change your passwords before that exposure is used against you.
What should I do with a package I didn't order?
- Don't scan the QR code or contact the sender. Some brushing packages include a note with a QR code that claims to show who sent it or to start a return. The FTC warns that scanning it could lead to a phishing site built to steal information like credit card numbers, and the BBB warns it can lead to malware. Replying to the sender can also give a scammer more to work with.
- Keep it or throw it away. The FTC says you're legally entitled to keep unordered merchandise as a free gift, and you don't have to return it or pay for it. The FTC also advises caution about using the product, since you don't know who sent it.
- Tell the marketplace. If the package came through Amazon or another online marketplace, message the platform so it can investigate the seller.
- Change passwords on shopping accounts. Do it in case an account was compromised, and turn on two-factor authentication where it's offered.
- Check the credit reports. The FTC points to AnnualCreditReport.com, where you can check your credit reports for free.
- Look for reviews under your name. If you can find the seller, check for reviews posted as you and report them.
- Report it. Tell the FTC at ReportFraud.ftc.gov and the BBB at BBB.org/ScamTracker.
If unordered packages keep arriving, the BBB suggests refusing delivery for a while or using a package acceptance service for the orders you do make.
How is brushing different from a delivery text scam?
Both involve packages, but they work differently. In a brushing scam, a real package arrives and the scam is the fake review. In a delivery text scam, a message about a package that doesn't exist pushes you to click a link or pay a small fee. The rules for each are the same on one point: don't use links or codes from an unexpected message or package. For the text version, read our guides to package delivery text scams, USPS text scams, and how to avoid delivery and shipping scams.
The bottom line
A package you didn't order is usually a brushing scam, and the package is the least of it. Keep it or toss it, skip the QR code, and use the moment to tighten up passwords and check the credit reports. Guardio protects across devices, with the browser extension for Chrome and Edge and apps for iOS and Android, so a suspicious link on your computer and phone gets a second look.
Take the free scam quiz and get a free security scan
Sources
- FTC Consumer Alert, "That unexpected package you got could be a brushing scam," 20 August 2026
- FTC Consumer Advice, "Got a package you didn't order? It's probably a scam," 6 January 2025
- FTC Consumer Advice, "What To Do if You're Billed for Things You Never Got, or You Get Unordered Products"
- BBB Tip, "Don't scan QR codes on unexpected packages," published 12 February 2025, updated 16 October 2025
- BBB Tip, "Brushing scam indicates a serious problem for victims," 19 August 2024
FAQs
Is a brushing scam dangerous?
The package itself is usually a cheap item. The risk is the personal information behind it, and any QR code or link that comes with it. The FTC says an unexpected package can mean someone has, or is trying to get, your personal information.
Do I have to pay for or return a package I didn't order?
No. The FTC says companies can't send you unordered merchandise and then demand payment, and you don't need to return it.
Did someone hack my Amazon account?
Not necessarily. The BBB doesn't confirm a breach, and the sender may have found your address online. The FTC still recommends changing passwords on shopping accounts in case one was compromised.
Is it safe to use the item?
The FTC advises being careful about using it, since you don't know who sent it.
What if I already scanned the QR code?
Close the page without entering anything. If you did enter information, change the passwords for any affected accounts, turn on two-factor authentication, and watch the card statements and credit reports, as the BBB advises. Our guide on what to do if you click on a phishing link covers the next steps.
Where do I report a brushing scam?
Report it to the FTC at ReportFraud.ftc.gov, to the BBB Scam Tracker at BBB.org/ScamTracker, and to the marketplace the package came through.
.webp)
