Brushing scam: the package you didn't order, and the QR code you shouldn't scan
A package you never ordered, with your name on it, is almost always a brushing scam: an online seller shipped a cheap item to you so it could post a fake review as a 'verified buyer'. The parcel is yours to keep and you owe nothing. It also means your name and address are circulating, and the newer version adds a QR code that leads to a phishing page.
A brushing scam is an unordered package, usually a cheap item, shipped to you so a seller can post a fake "verified purchase" review in your name. The law says you can keep it and pay nothing. Don't scan any QR code in the box, change your shopping passwords, and watch your card statements.
Why a stranger sends you free things
Marketplaces weight reviews from people who actually bought the product. The Postal Inspection Service explains that the shipment exists to "give the impression that the recipient is a verified buyer"; the seller then writes the review itself. The FTC's August 2026 alert adds the QR-code twist: scanning the note "could take you to a phishing website designed to steal information" such as card numbers, usernames or passwords. The item is bait for a review; the QR code is bait for your accounts.
Don't scan the QR code. Treat any "scan to see who sent this" or "scan to return" card as the scam itself. If you already scanned it and typed anything in, change that password now and turn on two-factor authentication. The FTC has a separate alert on QR codes in unexpected packages.
What it means for your data
Someone had your correct name and address, which usually traces back to a data breach, a people-search site or a leaked marketplace account rather than anything you did. The inspectors' warning is that "your personal information may be compromised" and may be reused for later scams. The same lists feed robocallers: if unfamiliar calls start arriving after the parcel, look the numbers up before you answer.
What to do
- Don't scan the QR code and don't contact the sender; anyone who answers will try to get more information out of you.
- Keep it or toss it. The FTC says you don't have to return things you didn't order and don't have to pay for them. An unopened parcel with a return address can be marked "RETURN TO SENDER" and USPS carries it back free.
- Change the passwords on your shopping accounts and turn on two-factor authentication.
- Check your card and bank statements for charges you don't recognize, and check your credit reports (free weekly at AnnualCreditReport.com); consider a fraud alert or credit freeze.
- If it came through a marketplace, report the seller to the platform and ask for the fake review in your name to be removed.
- Report it at ReportFraud.ftc.gov. Seeds, liquids or anything organic: don't plant or use them; the Postal Inspection Service says to notify the proper authorities instead.
More scams explained: wrong-number texts, Publishers Clearing House impostors and jury duty arrest threats. Got a number that called you? Look it up.
Frequently asked questions
What is a brushing scam?
A seller ships a cheap item you never ordered to your real name and address, marks it delivered, and posts a review in your name as a 'verified buyer' to lift its ratings and sales. The package is the by-product; the fake review is the point. The FTC and the U.S. Postal Inspection Service both describe it as a scam.
Do I have to pay for or return a package I didn't order?
No. Federal consumer protection rules say you don't have to return unordered merchandise and don't have to pay for it. You can keep it or throw it away; an unopened parcel with a return address can be marked 'Return to sender' and USPS carries it back at no charge.
Is it safe to scan the QR code that came in the package?
No. The note says to scan it to learn who sent the package or to arrange a return, but the code opens a phishing site built to collect card numbers, usernames and passwords, and can install malware. If you already scanned it and entered anything, change that password and turn on two-factor authentication.
Does a brushing package mean my identity was stolen?
It means your name and address are in someone's hands, which usually traces to a data breach or a leaked marketplace account; it does not by itself mean accounts were opened in your name. Change your shopping passwords, check card statements, and review your credit reports for activity you don't recognize.
Why would a seller send me free products?
Because marketplaces trust reviews from verified buyers. By shipping a real item to a real address, the seller can mark an order complete and attach a glowing review to it. The cheapest items that survive shipping are the usual choice: seeds, wipes, phone cases, cheap jewelry.
Who do I report a brushing scam to?
Report the seller to the marketplace the package came through and ask for the fake review in your name to be removed, report it to the FTC at ReportFraud.ftc.gov, and report mail-related fraud to the U.S. Postal Inspection Service at uspis.gov.
Sourced from the official NANPA (North American Numbering Plan Administrator) numbering database, current as of October 21, 2026. Refreshed monthly.