Skip to main content
Red Flag Briefing — home

Guide Delivery & toll texts

Got a Package You Didn't Order? It May Be a Brushing Scam

Unordered packages can mean someone is using your name for fake reviews, or bait for a QR code scam. What brushing is and what to do.

By Nathan Fielder Checked against official sources

Published

Quick answer

A brushing scam is when a seller ships you items you didn't order so it can post fake reviews in your name. The FTC says you don't have to pay for or return unordered items. Don't scan any QR code in the package, change your online shopping passwords and tell the marketplace about the seller.

A box shows up on your doorstep with your name on it, but you didn’t order anything. Inside is something cheap and random: a pack of seeds, a tube of toothpaste, baby wipes. It’s not a mistake and it’s not a gift. According to the FTC, it could be a brushing scam.

For other delivery-related scams, see our guide to fake delivery and toll-road texts.

What is a brushing scam?

In a brushing scam, a seller ships you something you didn’t order so it has “proof” of delivery. Then it uses your name to post fake reviews about its products, “brushing up” its sales and ratings. The FTC says these packages may look like they come from a well-known company like Amazon, or from a person or business you’ve never heard of.

The FTC also warns that an unordered package could be a sign that someone has your personal information, or is looking to steal it.

Do you have to pay for or return items you didn’t order?

No. The FTC says that by law, companies can’t send you merchandise you didn’t order and then demand payment. You never have to pay for things you get but didn’t order, and you don’t need to return them. You’re legally entitled to keep unordered merchandise as a free gift.

The FTC adds one caution: be careful about using the product, since you don’t know who sent it or what’s really inside.

If you start getting bills for things you never ordered, that’s a different problem. Contact the company, and your card issuer if a charge appears on your statement.

Why is there a QR code in the package?

Newer brushing packages sometimes include a note with a QR code. The FTC says the note might tell you to scan it to find out who sent the package or to process a return. Scanning could take you to a phishing website designed to steal your credit card numbers, usernames or passwords.

EXAMPLE — SCAM
A note from an unordered package pushing a QR code scan This is a made-up example based on real scam reports. Never reply to, call, or tap links in messages like this.

Don’t scan it. Read more in our guide to QR code scams.

What should you do to protect your accounts?

The FTC recommends:

  1. Change your passwords on all your online shopping accounts, in case they were compromised.
  2. Tell the marketplace. If the package came through Amazon or another online marketplace, message the platform so it can investigate and remove the seller.
  3. Check your credit. You can check your credit reports weekly for free at AnnualCreditReport.com. Look for accounts you don’t recognize. See what to do about identity theft.
  4. Report it to the FTC at ReportFraud.ftc.gov.

It’s also a good idea to turn on two-step verification where you can.

Unexpected packages often travel with unexpected delivery texts. If you get a text about a package you don’t recognize, don’t tap the link. See USPS will never send you this text and how to report a scam text.

If you scanned a code and entered card or login details, change those passwords and follow our first-hour checklist after a scam.

Red flags: how to spot this scam

  1. A package arrives addressed to you that you didn't order, often with something cheap inside like seeds, toothpaste or baby wipes.
  2. A note in the package asks you to scan a QR code to see who sent it or to process a return.
  3. Reviews appear online under your name for products you never bought.

What to do

  1. Don't scan any QR code that comes with an unordered package.
  2. Change the passwords on your online shopping accounts.
  3. If the package came through Amazon or another marketplace, message the platform so it can investigate the seller.
  4. Check your credit reports for signs of identity theft.
  5. Report the brushing scam to the FTC at ReportFraud.ftc.gov.

Send this to someone you love

A quick share can stop a scam before it starts.

Share on Facebook (opens in a new tab) Send by email Send by text message

See our scam alerts first in Google

If you use Google Search, you can choose Red Flag Briefing as a preferred source so our warnings show up more often in Top Stories.

Add Red Flag Briefing as a preferred source on Google

Where to report it

Reporting helps investigators spot patterns and warn others — even if you did not lose money. Type these addresses yourself or use the links below; do not use links from a suspicious message.

  • U.S. Postal Inspection Service

    Fake USPS texts and emails, and fraud that uses the U.S. Mail.

    uspis.gov/report

  • Federal Trade Commission (FTC)

    Any scam, fraud or bad business practice — calls, texts, emails, websites and impostors.

    ReportFraud.ftc.gov

  • Federal Communications Commission (FCC)

    Unwanted robocalls, spoofed caller ID and spam texts.

    consumercomplaints.fcc.gov

  • FBI Internet Crime Complaint Center (IC3)

    Online and computer-related fraud, including tech-support, romance, investment and crypto scams.

    IC3.gov

You can also report to your state attorney general. If you sent money, call your bank or card company right away using the number on the back of your card.

Frequently asked questions

Can I keep a package I didn't order?

Yes. The FTC says the law doesn't require you to return things you didn't order or pay for them; you can keep unordered merchandise as a free gift. It does suggest being cautious about using the product, since you don't know who sent it.

Does a brushing package mean my account was hacked?

Not necessarily, but the FTC says it could be a sign that someone has, or is trying to steal, your personal information. As a precaution, change the passwords on your online shopping accounts and check your credit reports.

Should I scan the QR code inside?

No. The FTC warns that a QR code note in an unordered package may lead to a phishing website designed to steal credit card numbers, usernames or passwords.

Sources

We rely on official government sources. Read how we check facts in our editorial policy.

  1. FTC consumer alert: That unexpected package you got could be a brushing scam (Aug. 20, 2026) (consumer.ftc.gov, accessed )
  2. FTC: What To Do if You're Billed for Things You Never Got, or You Get Unordered Products (consumer.ftc.gov, accessed )
  3. FTC consumer alert: See a QR code parked somewhere? Don't scan it…yet! (Sept. 3, 2026) (consumer.ftc.gov, accessed )

Related scams

  • Guide Email & phishing

    QR Code Scams: When Not to Scan

    Fake QR codes on parking meters, packages and emails lead to phishing sites. How QR code scams work and how to pay or check safely.

  • Guide Text message scams

    Wrong Number Text Scam: Why You Shouldn't Reply

    A friendly text meant for 'someone else' can be the first step of a romance or investment scam. Why it's safe to ignore it and what to do instead.

See all articles about fake delivery and toll texts