Brushing Scam Alert: What to Do About Unexpected Packages

consumer-alertbrushing-scamphishingidentity-theftonline-shopping

The box on your doorstep looks ordinary enough — but you never ordered what’s inside. When a package shows up that you didn’t buy, it could be a brushing scam, and the FTC’s August 2026 consumer alert warns that the real problem may not be the item itself but the personal information someone used to send it to you.

How This Was Verified

We verified this alert against official sources rather than anecdotes: the primary reference is the FTC’s August 2026 consumer alert, supported by the FTC’s January 2025 alert and Amazon’s official help page, each of which was live and reachable at the time of writing.

  • Sources used: the FTC’s August 2026 consumer alert, published August 20, 2026; the FTC’s January 2025 alert; and Amazon’s official help page on unsolicited packages.
  • What we verified: the publication dates of both alerts, the guidance each contains, and that all cited URLs were live and reachable at the time of writing.
  • What we did not independently confirm: the number of consumers affected, the identity of specific sellers, or the final destinations of QR codes embedded in packages.

This report is based on official documentation and consumer alerts; we did not run hands-on tests. Last verified: August 2026.

What is a brushing scam?

A brushing scam is a scheme in which sellers ship unsolicited, inexpensive items to real addresses and treat the confirmed delivery as “validation” for posting fake, positive reviews in the recipient’s name, boosting seller ratings on marketplaces, according to the FTC’s August 2026 consumer alert and the FTC’s January 2025 alert.

The scheme inverts normal retail logic. A seller with a dormant listing ships lightweight merchandise to names and addresses it already holds — often yours, obtained without permission. Once tracking shows the package as delivered, the transaction counts as a real sale, and the seller posts praise for the product under your name. You never shopped, never agreed, and never profited; the FTC notes the goods are sometimes fake luxury items designed to make the listings look plausible to real shoppers.

Why did I get a package I didn’t order?

A package you did not order is usually part of a brushing scam: the box may appear to come from a well-known company or an unfamiliar sender, it often holds cheap random items such as baby wipes, toothpaste, or seeds, and it means someone likely has your personal information, according to the FTC and the FTC’s January 2025 alert.

Treat the arrival as a signal, not a shipping mix-up. The contents can be nearly anything lightweight, and the FTC’s January 2025 alert notes scammers sometimes ship fake luxury items to make the sender look legitimate. Deliveries like these often travel alongside other tricks: our August 14 consumer alert covers the fake package-delivery texts that frequently accompany schemes like this one.

What should I do if I get an unexpected package?

If a package you never ordered shows up, the FTC’s August 2026 consumer alert lays out a clear sequence: change your passwords, tell the marketplace, monitor your credit, refuse to pay or return anything, skip using the item, and report the fraud. Here are those steps in order.

  1. Change your passwords. Update the passwords on your shopping accounts first, and use a unique password for each account so a single leak doesn’t cascade into the others.
  2. Message the marketplace. Report the seller through the platform’s official channels. Amazon’s official help page states that the company investigates brushing reports, may suspend the sellers involved, and works with law enforcement where appropriate.
  3. Check your credit weekly. Pull your free reports at AnnualCreditReport.com and look for accounts or inquiries you don’t recognize.
  4. Keep it — you legally don’t have to return it or pay for it. Returning unsolicited merchandise only rewards the scheme and invites more contact from the sender.
  5. Don’t use the product. You don’t know where it came from, how it was stored, or what’s actually inside the packaging.
  6. Report the incident. File a complaint at ReportFraud.ftc.gov so federal consumer protection trackers capture the case.

Want a quick read on your exposure? Run our free scanner to check whether your data has appeared in known breaches.

Is the QR code in my package safe to scan?

A QR code tucked inside an unexpected package is not safe to scan: scammers include notes with QR codes that claim to reveal the sender or process a return, but scanning one can lead to phishing sites built to steal credit card numbers, usernames, and passwords, according to the FTC’s August 2026 consumer alert and the FTC’s phishing guide.

The FTC’s phishing guide describes how these schemes work: fake messages and pages that imitate trusted brands, press for urgent action, and quietly harvest whatever you type. Treat the note in the box the way you’d treat a suspicious text message — as an attack, not customer service. If you already scanned a code and entered card details or credentials, change those passwords immediately and watch your accounts for unfamiliar activity. To identify a real sender, look up the company’s official website yourself rather than trusting the code.

Does getting a brushing package mean my identity was stolen?

Receiving a brushing package does not prove your identity has been fully stolen, but it is a clear sign that someone has your personal information or is actively trying to collect more, so treat it as an early warning and follow the FTC’s identity theft guide along with the FTC’s August 2026 consumer alert.

Scammers running brushing operations only need the basics — a name and a shipping address — which may come from a leak, a public record, or an earlier breach rather than a full identity theft, as the FTC’s January 2025 alert makes clear. Still, don’t shrug it off. Watch for warning signs such as accounts you never opened or charges you don’t recognize, and act on them using the FTC’s identity theft guide. Meanwhile, keep the merchandise; you don’t need to contact the sender, and doing so only extends the conversation.

FAQ

Do I have to return a brushing scam package?

No. You do not have to return a brushing scam package or pay anything for it — the FTC states that unsolicited merchandise is legally yours to keep. Skip contacting the sender to arrange a return; that only opens the door to further scammer contact. Keep or discard the item and focus on securing your accounts.

Can I report a brushing scam to Amazon?

Yes. Amazon’s official help page says the company investigates reports of brushing, may suspend sellers involved, and works with law enforcement where appropriate. Report the unsolicited package through Amazon’s customer service channels, and file a separate complaint at ReportFraud.ftc.gov so consumer protection agencies can track the scam and warn others.

How do I check if my data was exposed?

Start with your credit reports: AnnualCreditReport.com provides free weekly reports you can review for accounts or inquiries you don’t recognize, and the FTC’s identity theft guide lists warning signs of misuse. Also check marketplace order histories and bank statements, change passwords, and turn on two-factor authentication on your email and shopping accounts.