Brushing scams: the package you never ordered is a warning, not a gift

A box lands on your doorstep. Your name, your address, no mistake — except you didn’t order anything. Inside is something cheap and random: a ring, a phone charger, a Bluetooth speaker, a packet of seeds. No invoice, no sender, sometimes a card that just says “gift.” This is a brushing scam, and the package is not the product. It exists so that, somewhere on a shopping platform, a glowing “verified purchase” review can be posted in your name — and it means your personal details are already circulating in places you never put them.

Three first moves, before the detail: don’t pay anyone, don’t scan any QR code that came in the box, and know that you’re allowed to keep what arrived.

Why anyone would mail you free stuff

Marketplaces rank products partly on sales and reviews from verified buyers — and a review tied to a real, tracked delivery carries weight that an invented one doesn’t. So a seller who wants a cheap or knock-off product to look popular manufactures the evidence: ship the lowest-value trinket possible to a real name at a real address, let the platform log a genuine delivery, then write a five-star review under the “buyer’s” name. Per the US Postal Inspection Service, “the sender of the item(s) is usually an international, third-party seller who has found the recipient’s address online.”

The FTC’s 2025 alert on these packages describes the same machine: sellers of knock-off merchandise find your address online, send goods you never ordered, and use your information to post fake reviews that boost their sales. The item in the box is junk by design — its only job was to generate a tracking number.

The package is a symptom, not the problem

Here’s the part worth taking seriously. The trinket cost the seller a dollar; what should bother you is how they addressed the label. The FTC’s alert is direct about the stakes: a package you didn’t order likely means someone has your personal information. Maybe it’s only your name and address, scraped or bought from some leaked database — or maybe it travels with your phone number and email, ready to be used in the next, less harmless scheme.

So treat a brushing package as a tripwire, not a windfall. Check your shopping accounts for orders you didn’t place and reviews you didn’t write. Watch your card statements. If you find activity that isn’t yours, our guide to what to do after a data breach walks through the full sequence.

The QR-code twist: never scan the “gift” card

A newer variant weaponizes your curiosity. The package contains a note: it’s a gift — but to find out who sent it, or how to return it, you’re invited to scan a QR code. The FTC warned in a January 2025 alert that the code can lead to a phishing site that steals credit card numbers or usernames and passwords, or downloads malware that gives the scammer access to your phone. The FBI issued its own alert in July 2025 about criminals mailing unsolicited packages containing QR codes — often with no sender information at all, precisely so the code is the only way to “find out.”

That’s the tell in its purest form: a mystery engineered so that scanning feels like the natural next step. It isn’t. The mechanics of hidden-link codes — and the preview-the-URL habit that beats them — are covered in our guide to QR-code “quishing” scams.

Not the same as the “package held” text

Don’t confuse brushing with the delivery text that says a parcel is stuck and needs a small fee. That scam invents a package that doesn’t exist to rush you to a fake courier page — see how delivery smishing works. Brushing is the mirror image: the package is real, nobody asks you for money, and the harm runs through your name and your data instead of your card. Free-and-unasked should raise your guard as fast as urgent-and-demanding.

What to do with the box

• Keep it or toss it — but never pay. The FTC’s guidance on unordered merchandise is that you have a legal right to keep it as a free gift. USPIS says the same, and adds that an unopened package can be marked “Return to Sender” for free.
• Don’t plant, eat, or use anything questionable. USPIS advises reporting unknown substances or seeds and other organic material to the authorities rather than handling them.
• Report the fake review machinery. Tell the marketplace (so reviews in your name come down), report the package to USPIS at uspis.gov/report or 1-877-876-2455, and file with the FTC at ReportFraud.ftc.gov. If you scanned a code, add a report to the FBI at IC3.gov.

Then lock the front door

Because the real message of a brushing package is your details are out there, the durable response is Lock the Front Door: make your accounts hard to take over before anyone tries. Change the passwords on your shopping accounts and the email behind them, turn on two-factor authentication, and keep an eye on your statements and free credit reports. If you see signs your identity is being used, a free credit freeze stops new accounts being opened in your name and costs nothing.

The box itself is the cheapest part of the scam — don’t let it be the last thing you check. See the rest of the free defense moves, or test your eye on the 60-second quiz.