Brushing Scam: Why You Got a Package You Did Not Order
A package you never ordered can be a sign that someone has your name and address.
By Siddharth ShankarUpdated October 23, 2026In an August 20, 2026 alert the FTC explained brushing scams. You receive a package you did not order, often cheap random items such as baby wipes, toothpaste or seeds. The sender wants a confirmed delivery to your address so it can post fake reviews under your name. The FTC says the package may signal that someone has your personal information or wants to get it, and some include a QR code that leads to a phishing site. Change shopping passwords, report the seller, check your credit reports and report the scam.
Scammers start with details that have already leaked. Is your email one of them?
Free · About 30 seconds · No sign-up · Email not stored
Getting a free item sounds harmless. The Federal Trade Commission says an unexpected parcel can be part of a scheme that uses your name and address, and it can be a signal about your personal data. This guide follows the FTC’s consumer alert from August 2026.
What a brushing scam is
In a brushing scam, you receive a package you did not order. It may look like it comes from a known retailer or from a sender you do not recognise. The FTC says recent reports describe cheap, random contents such as baby wipes, toothpaste or seeds.
Why senders do it
The goal is a confirmed delivery to your address. With a delivery on record, the sender can then post fake reviews under your name to boost its own sales. You are not the target of the goods. You are a name and address that can be used to make the reviews look real.
What it can mean for your information
The FTC says the package may signal that someone has your personal information or wants to get it. Some packages include a note with a QR code, claiming that scanning it will reveal the sender or process a return. The FTC says scanning can lead to a phishing site that steals credit card numbers, usernames or passwords. Our guide on QR code scams explains how those links work.
Your best defence is knowing what scammers may already have. Check your email free.
Free · About 30 seconds · No sign-up · Email not stored
What to do
The FTC suggests these steps:
- Change the passwords on your online shopping accounts.
- Report the seller to the platform if the package came through an online marketplace so it can investigate.
- Check your credit reports regularly. You can get free reports at AnnualCreditReport.com and look for signs of identity theft.
- Know your rights. You do not have to return or pay for items you did not order.
- Be cautious with the product, since you do not know where it came from.
- Report the scam at ReportFraud.ftc.gov.
Extra steps worth taking
These go beyond the FTC alert but follow from it.
- Do not scan any QR code or follow any link that came with the package.
- Check whether a seller account has posted reviews under your name, and ask the platform to remove them.
- Search for your name and address to see where they are listed. Our guides on why people search sites have your address and how to find yourself on people search sites help.
- Turn on two-factor authentication for shopping and email accounts.
How did they get my address?
There is no single answer. Addresses appear in data breaches, in public records and on people search sites, and sellers can buy lists. Read what data brokers are and how scammers get your details. If you want to reduce the chance of it happening again, work through how to remove your address from the internet.
Is it identity theft?
A brushing package on its own is not proof of identity theft. It is a prompt to look. Check your accounts and credit for anything unfamiliar. If something is wrong, follow what to do if your identity is stolen.
Keep records
Keep the packing slip, the outer label and any photographs. They help the platform and, if needed, the FTC.
Sources
- FTC Consumer Alert: That unexpected package you got could be a brushing scam (August 20, 2026) (definition, purpose, risks, steps)
Frequently asked questions
What is a brushing scam?
You receive a package you did not order so the sender can get a confirmed delivery and post fake reviews in your name.
What is usually in the package?
The FTC says recent reports describe cheap random items such as baby wipes, toothpaste or seeds.
Does it mean my data was stolen?
The FTC says it may signal that someone has your personal information or wants to get it, so check your accounts and credit reports.
Do I have to pay for or return it?
The FTC says you do not have to return or pay for items you did not order.
What should I do?
Change shopping passwords, report the seller to the platform, check your credit reports, avoid any QR code and report it at ReportFraud.ftc.gov.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Get alerted when your email leaks
Every NordVPN plan includes Dark Web Monitor, which alerts you if your email appears in new leaks.
See NordVPN →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.