If a package you never ordered shows up addressed to you, treat it as a possible brushing scam before you treat it as a gift. In a brushing scam, a scammer uses your name to leave a fake review for that package you didn’t order. The same event can also be a sign that someone has, or is looking to steal, your personal information.
This guide covers what the source confirms, what it leaves open, and a practical order of steps. It separates the incident itself from the follow-up actions, because the two carry different levels of certainty.
What a brushing scam looks like
The pattern starts with an unexpected package that looks like it’s from a known company like Amazon, or from a person or business you’ve never heard of. The package is addressed to you. Recent reports to the FTC say it usually has something cheap and random inside, like baby wipes, toothpaste, or seeds.
The motive is review manipulation, not generosity. Scammers do this so they have “validation” of delivery. Then they use your name to place fake reviews online about their business to “brush up” their sales. The delivery record is the prop; your name on a review is the product.
The QR code twist
Sometimes, the sender might leave a note with a QR code inside the package. It might say to scan to find out who sent the package, or to process a return. The instruction feels helpful, which is the point.
Scanning could take you to a phishing website designed to steal information like your credit card numbers, usernames, or passwords. A note inside an unordered parcel is not a trusted channel, whatever it claims about returns or sender identity.
Response checklist, in order
- Do not scan the code. Treat any QR note in an unexpected package as untrusted.
- Change passwords on all your online shopping accounts in case they were compromised.
- Report to the marketplace. If the package came from Amazon or another online marketplace, message the platform so they can investigate removing the seller.
- Check your credit weekly for free at AnnualCreditReport.com.
- Monitor the information in your credit report and look for signs of identity theft.
- Know your rights on the item. The law says you don’t need to return things you didn’t order, and you don’t have to pay for them, either.
- Be cautious about using the product. An unordered item is not a free sample you can trust.
The ordering matters. Password changes and platform reporting limit further exposure; credit monitoring catches misuse that has already happened. Neither step depends on confirming who sent the parcel.
How to read the status of an incident
Unordered packages often arrive without any official notice, so readers have to assemble the timeline themselves. Keep these stages distinct:
| Stage | What you have | What it does not prove |
|---|---|---|
| Delivery observed | A package addressed to you with cheap, random contents | Who sent it, or why |
| Pattern suspected | It matches the brushing pattern described in recent FTC reports | That your accounts are compromised |
| Exposure suspected | A QR note or a fake review under your name | That any specific data was stolen |
| Action taken | Passwords changed, platform messaged, credit report checked | That the matter is closed |
Most readers will be somewhere between the first and third rows when they start looking for answers. The source does not describe a formal notification process for brushing scams, so there is no official status page to check.
A worked example
Hypothetical: a reader receives a padded envelope addressed to them, postmarked from an unfamiliar sender, containing toothpaste and a slip with a QR code. They have not ordered anything.
Under the source’s guidance, the reader would skip the code, change shopping-account passwords, message the marketplace if the label suggests one, check credit weekly, and keep the toothpaste rather than return or pay for it, while being cautious about using it. Nothing in that sequence requires identifying the sender first.
What the source does not say
The source does not state how often unexpected packages are brushing scams versus simple misdeliveries or gifts. It does not name specific marketplaces beyond Amazon as an example, and it does not describe how platforms handle seller removal requests or how long investigations take.
It does not say whether the recipient should keep, discard, or report the package to any authority, beyond the legal point that return and payment are not required. It does not explain how to find or request removal of a fake review left under your name, and it does not specify what signs of identity theft to look for in a credit report.
It also does not address whether a QR code note can be safely inspected without scanning, or what to do if a code was already scanned. Those gaps are worth knowing before drawing conclusions about your own case.
Bottom line
An unexpected package addressed to you is a prompt to check your accounts, not proof of a breach. Follow the source’s steps in order, keep the delivery, suspicion, and confirmed-exposure stages separate, and do not let a note inside the box set your next move.