The brushing scam: a package you never ordered

Scam guide · Updated October 13, 2026

A package shows up with your name and address on it. You didn't order anything. Inside is something cheap and random, like baby wipes, toothpaste or a packet of seeds, and no note explaining why. In August 2026 the Federal Trade Commission warned that this could be a “brushing” scam. The FTC says the package may come from a company you know, such as Amazon, or from a sender you've never heard of. (FTC)

What a brushing scam is

According to the FTC, the sender may be using your name to post fake reviews, or may be trying to get your personal information. Scammers want “validation” that something was delivered. They then use the delivery, and your name, to boost their own sales with reviews that look real. (FTC) You didn't do anything wrong. The package is a cheap way for the sender to make a sale look real.

The part that can cost you money

Sometimes there's a note or card in the box. The FTC warns that a note may ask you to scan a QR code to find out who sent the package or to start a return. That code can lead to a phishing site built to steal credit card numbers, usernames or passwords. (FTC)

Signs it's a brushing package

• You didn't order it, but your name is on it.
• It's cheap and random: the FTC's examples are baby wipes, toothpaste and seeds.
• It may look like it came from a known company, or from a sender you don't recognize.
• There's a QR code or link inviting you to find out who sent it or to start a return.

What to do

1. Don't scan the QR code. The FTC specifically says not to. (FTC)
2. Don't pay for it. You don't need to return unordered products, though the FTC advises being cautious about using them, since you don't know who sent them.
3. Change the passwords on your online shopping accounts. The FTC says the sender may be trying to get your personal information.
4. If it came through Amazon or another marketplace, message the platform so it can investigate the seller.
5. Watch your credit. The FTC suggests checking your credit report weekly for free at AnnualCreditReport.com and looking for signs of identity theft.
6. Report it at reportfraud.ftc.gov.

If you already scanned the code or entered information

Don't engage with whoever contacts you through that page. If you entered a username, password or card number, change that password right away everywhere you use it, then check your card and bank statements for charges you didn't make and call your card issuer using the number on the back of your card. Report it at reportfraud.ftc.gov. Our guide on how to report a scam lists where else to send it.

Fake reviews are the point

The fake reviews are the reason these packages exist. In August 2024 the FTC announced a final rule banning fake reviews and testimonials, including AI-generated ones, and the buying or selling of reviews. (FTC) Reporting the package and telling the marketplace helps them find the seller.

Common questions

Is a package I didn't order a scam?

It can be. The FTC says an unexpected package could be a brushing scam, where a sender uses your name to post fake reviews or tries to get your personal information. Don't scan any QR code that comes with it.

Do I have to send back a package I didn't order?

The FTC says you don't need to return unordered products, and you shouldn't pay for them. It advises being cautious about using them since you don't know who sent them.

Should I be worried that someone has my information?

It's worth a few precautions. The FTC suggests changing your online shopping passwords and checking your credit report free at AnnualCreditReport.com. Report the package at reportfraud.ftc.gov.

Related: the QR code parking scam, the USPS “package on hold” text, is that Amazon text real? and how to check if a link is safe.

← All scam guides