Got a Package You Didn’t Order? Don’t Open It Yet – It Could Be a Brushing Scam

A package shows up at your door with your name on it. You check your recent orders, and nothing matches. Maybe it is a cheap gadget, a beauty product, seeds, jewelry, or something you would never buy.

It is tempting to think someone sent you a gift.

Read next: Rental scam alert how apartment hunters are being deceived

Before you scan a QR code, call a number, click a link, or try to figure out who sent it, stop. An unexpected package can be part of a brushing scam, and the Federal Trade Commission has warned that these packages can also be used to steal personal information.

The good news is that you do not need to panic. You do not need to pay for the item either. If you know you did not order it, there are a few simple steps that can protect your accounts and your identity.

Read next: The Credit Card Rate Scam That Wants Your Money First

What a brushing scam looks like

A brushing scam starts with something that seems harmless.

A seller or scammer gets your name and address and sends you a product you never ordered. The item may be cheap and completely random. The goal is often not to make money from the item itself.

Read next: Is ShopVSB.com Legit? Vitamin Sea Boutique Review 2026

The seller wants to make the product look more popular online.

Here is the basic trick. A seller sends products to real people, then uses fake buyer accounts to create reviews or other activity around those products. Those reviews can make the product appear to have more customers and better feedback than it really does.

That can help the seller attract genuine buyers.

The FTC describes brushing scams as a situation where scammers or sellers of knockoff products get your address or other personal information, send you something you never ordered, and use your information to create fake reviews in your name.

So the strange package is not necessarily the main problem.

The bigger problem is that someone may have your personal information.

Why the package can be more dangerous than it looks

Getting a random package does not automatically mean your bank account has been hacked.

It does mean you should pay attention.

Your name and address may have been exposed through many different sources. Information can be available online, held by companies you have dealt with, or exposed in a data breach. You may never know exactly where the scammer got it.

That is why the package is worth treating as a warning sign.

The FTC says an unexpected package may mean someone has your personal information, and recommends checking your accounts and credit for signs of identity theft.

There is another problem that can be easier to miss.

The package itself may be used to start a second scam.

You may see a card inside saying you have received a gift. It may tell you to scan a QR code to identify the sender, claim a reward, register the product, or arrange a return.

That is where things can get worse.

Do not scan the QR code

This is one of the most important things to remember.

If an unexpected package contains a QR code, do not scan it just because the message looks professional.

The FTC has warned that QR codes connected to unexpected packages can lead to phishing websites designed to steal passwords, usernames, credit card numbers, or other personal information. In some cases, a malicious QR code can also lead to malware.

A scammer does not need to break into your bank account if you hand over the information yourself.

A fake page can look almost identical to a real shopping site. It might have the right logo, familiar colors, and a form asking for your name, phone number, email address, or card details.

You might think you are registering a free gift.

You could actually be giving your information to a scammer.

The return instructions can be a trap too

A common reaction to an unwanted package is to search for the sender and try to return it.

That sounds reasonable. It can also put you in contact with the wrong person.

The FTC specifically advises people who receive an unexpected package not to contact the sender. Someone responding to your message may use the conversation to ask for more sensitive information or money.

You do not need to solve the mystery yourself.

If the package came through a marketplace, contact that marketplace through its official website or app. Do not use a phone number printed on a suspicious card.

If you use USPS and the package is unopened and has a return address, the U.S. Postal Inspection Service says you can mark it "RETURN TO SENDER."

What you should do with the package

You are not required to pay for merchandise you never ordered.

The U.S. Postal Inspection Service says unsolicited merchandise can be kept without payment. If you opened the package and do not want the item, it can also be thrown away if the contents are safe to dispose of.

There is one important exception.

Do not handle unknown liquids, powders, food, plants, seeds, or other suspicious material casually. The Postal Inspection Service advises contacting the proper authorities if unsolicited merchandise contains organic material or an unknown substance.

You also do not have to feel guilty about keeping an ordinary item.

The point is not the value of the product. The point is protecting your information.

Check your shopping accounts

After receiving an unexpected package, check the online stores you use.

Look at your recent orders. Check saved addresses. Look at payment methods. Review account activity and make sure nothing else looks unfamiliar.

If you find an order you did not place, treat that differently from a simple brushing package. Someone may have accessed your account.

Change the password immediately.

Do not reuse that password on other websites. If the same password is used somewhere else, change it there too.

The FTC recommends changing passwords on online shopping accounts after receiving an unordered package because the account may have been compromised.

Adding two-factor authentication can also make it harder for someone to access your account with only a stolen password.

Check your bank and credit cards

A strange package does not prove that someone has stolen your money.

Still, it is worth checking.

Open your bank and credit card apps and look through recent transactions. Pay attention to charges you do not recognize, especially small charges that may have been made to test whether a card works.

If you see something you did not authorize, contact your bank or card issuer using the number on your card or the official banking app.

Do not call a number printed on an unexpected package.

That small difference matters.

Check your credit report

If you are concerned that your personal information has been exposed, check your credit report for accounts or activity you do not recognize.

The FTC says you can get your credit reports for free at AnnualCreditReport.com, and its current consumer advice says you can check your credit reports weekly for free.

Look for credit cards, loans, accounts, or other activity that does not belong to you.

If you see something suspicious, do not ignore it.

The sooner you investigate an unfamiliar account, the easier it can be to limit the damage.

Report the package

Reporting an unwanted package takes a few minutes, but it gives companies and investigators another piece of information about how the scam is being used.

If the package came from a shopping marketplace, report it through the company's official customer support or fraud reporting system.

Tell them that you received an item you did not order and provide the order or tracking information if you have it.

The U.S. Postal Inspection Service specifically recommends notifying the retailer when unsolicited merchandise arrives from Amazon, eBay, or another third-party seller and asking the company to investigate fake reviews connected to your name.

You can also report the scam to the FTC at ReportFraud.ftc.gov. The FTC says reports help investigators spot trends, build cases, and warn other people about scams.

Why seniors should take these packages seriously

Older adults are not the only people who can receive brushing packages.

Anyone can become a target.

But an unexpected package can be especially confusing for someone who does not spend much time shopping online. A person may assume that a family member ordered something for them or that the package is connected to a promotion.

That confusion is exactly what a scammer can use.

A card saying "Scan to identify your sender" may seem helpful. A message saying "Claim your free gift" may sound harmless.

It is better to ignore the instructions and check the situation yourself.

If you are helping an older parent, grandparent, neighbor, or friend, make this rule easy to remember:

If they did not order the package, they should not scan anything inside it, call a number from the package, or enter personal information into a website connected to it.

Then check the account and report the package through an official channel.

How scammers may have gotten your address

This is the part that often bothers people most.

You may wonder, "How did they even get my name and address?"

There is no single answer.

Personal information can appear in public records, old databases, online directories, data held by companies, or information exposed through security incidents. Some companies also collect and share customer information for legitimate business purposes, which means your details can travel further than you realize.

A scammer does not necessarily need your shopping password.

For a brushing scam, having your name and delivery address may be enough to send an item to you.

That does not mean the scammer knows everything about you.

It means you should take the opportunity to tighten up your accounts.

The fake review problem

Reviews have a huge effect on online shopping.

Before buying a product, people often look at the star rating, read a few comments, and check how many people have reviewed it.

That creates an opening for dishonest sellers.

If a seller can make a product look as though it has been purchased and reviewed by many real people, the product can appear more trustworthy than it deserves.

That is why brushing is useful to the scammer.

The seller is not sending you a package because they want you to enjoy it. The package can be part of an attempt to create fake sales or reviews and make the product look more successful.

The exact method can vary from one marketplace to another.

That is also why you should not assume every unsolicited package means your shopping account has been hacked. It may simply mean your name and address were obtained somewhere and used for the scheme.

What if you already scanned the QR code?

Do not panic.

If you scanned the code but did not enter anything, close the page and do not continue.

If you entered a password, change that password immediately. If you use the same password on other accounts, change those accounts too.

Turn on two-factor authentication where available.

If you entered credit card or bank information, contact the financial institution using a phone number or website you already know is legitimate.

The FTC also recommends taking action if you entered personal information after scanning a malicious QR code.

If you downloaded something or believe your phone or computer may have been compromised, update the device and review its security settings.

The key is to act quickly instead of spending hours trying to figure out who sent the package.

What if you already called the number?

The same basic rule applies.

If you only called and did not provide information, end the conversation and do not call back.

If you gave the person your password, change it.

If you gave them financial information, contact your bank or card issuer.

If you gave away sensitive identity information, follow the identity theft steps recommended by the FTC.

And watch out for another scam after the first one.

Someone may contact you later and claim they can "fix" the problem or recover your information. They may ask for a fee or more personal details.

Do not assume the person who offers help is legitimate just because they know about the original package.

Do not make the package bigger than it is

There is a tendency to assume the worst after hearing about scams.

You receive one random package, and suddenly you think your identity has been completely stolen.

That is not necessarily true.

A brushing package can mean someone has your name and address. It does not automatically mean they have your bank password, Social Security number, or credit card number.

Take the warning seriously without jumping to conclusions.

Check your accounts. Change passwords if needed. Watch your credit. Report the package.

Then move on unless you find something else that needs attention.

What marketplaces can do

Online marketplaces have a difficult job because sellers can create new accounts, change listings, use different products, and try new ways to manipulate reviews.

Platforms can remove sellers and fake reviews, but no system catches everything immediately.

That is why customer reports matter.

If you receive an unwanted package connected to a marketplace, give the company enough information to investigate it. Keep the shipping label if you can. Take a photo of the package before throwing anything away if the details may help with a report.

Do not click a suspicious link just because you want to provide more information to the marketplace.

Use the marketplace's official app or website instead.

A simple rule for your household

You do not need to remember the term "brushing" to protect yourself.

Remember the behavior.

If something arrives that nobody in your household ordered, slow down.

Do not scan the QR code. Do not call the number printed on an unfamiliar card. Do not click a link telling you to claim, return, register, or identify the package.

Check your shopping accounts through the normal app or website.

That takes less time than dealing with a stolen password or fraudulent card later.

If you help an older family member

Make this conversation simple.

Tell them that an unexpected package is not automatically a free gift. Someone may have used their name and address without permission.

Show them what a suspicious QR code or card might look like.

Then give them a clear plan:

• Do not scan it. A QR code inside an unexpected package can lead to a fake website designed to steal information.

• Do not call the number on the card. Use the official website or app of the company involved.

• Check the account. Look for orders, payment methods, or activity that nobody recognizes.

• Report the package. Tell the marketplace and report the scam to the FTC if appropriate.

The goal is not to make older adults afraid of packages.

It is to make the right response automatic.

What this scam can teach you

The biggest lesson is simple.

Your personal information has value even when it does not look valuable.

A name and address may seem harmless. But in the hands of a scammer, those details can be combined with other information to create fake accounts, send unwanted merchandise, target you with phishing attempts, or support other scams.

That is why an unexpected package should make you pause.

You do not need to throw away every package you receive. You do not need to stop shopping online.

You just need to know what is yours and what is not.

What to do if a package arrives tomorrow

If another package appears on your doorstep tomorrow and nobody in the house ordered it, do not guess.

Start with the label.

Check the sender and tracking information without using a suspicious QR code or link. Check your shopping accounts through their normal apps or websites. If nothing matches, report the package to the marketplace involved.

Then check your bank and credit card activity.

If everything looks normal, you may simply have received an unwanted package as part of a brushing scam.

If you find an unfamiliar order, charge, account, or password change, take it more seriously and contact the affected company directly.

You are not responsible for the scam

Getting an unexpected package can feel embarrassing, especially if you already scanned something or spoke to someone before realizing what was happening.

Do not blame yourself.

Scammers design these tricks to look normal.

A package has your name on it. A QR code looks like a normal QR code. A website may look like a company you already know.

The safest response is to slow down.

You do not need to solve everything at once.

Check what happened, protect the accounts that matter, report what you saw, and tell someone you trust if you are unsure.

If you get a package you never ordered, the box itself is not the reason to panic. It is the reason to pay attention.