Got a package you didn't order? It may be a brushing scam
A package you didn't order is often a brushing scam, where a seller ships to you so it can post fake reviews in your name. You can keep it, and you don't have to pay for it. Don't scan any QR code inside, change your shopping passwords, and tell the marketplace.
A box shows up with your name on it. Inside is something cheap you never ordered, like seeds, a phone case, or a small gadget. There's no note from a friend. Sometimes there's a little card instead.
The note in the boxThank you for your order! Scan the QR code to see who sent your gift or to arrange a free return.
That's an example of the kind of note that comes in these boxes. It looks helpful. It's the part to be careful with.
How the scam works
The FTC calls this brushing. A seller ships a cheap item to a real person so it looks like a real sale. Then it posts fake five-star reviews in that person's name. The fake reviews help "brush up" its sales.
The box itself isn't the danger. The follow-up is. The FTC and the Postal Inspection Service warn that a QR code in the package can lead to a fake website that steals card numbers, usernames, and passwords.
The red flags
- A package you didn't order, often with no return address or a retailer's address.
- A QR code card asking you to scan it to find the sender or set up a return.
- A call or text asking you to pay for the item or "confirm" your details.
- Pressure to act now. You don't owe anything, so there's nothing to rush.
What to do
- Keep it or toss it. The FTC says you can keep unordered items as a free gift. You don't have to pay for them or send them back.
- Don't scan the QR code and don't call any number that came in the box.
- Change your passwords on your online shopping accounts, in case they were hacked.
- Tell the marketplace. If it came from Amazon or another online store, contact them so they can look into removing the seller and any fake reviews in your name.
- Check your credit report for free at AnnualCreditReport.com and look over your card and bank statements.
Already scanned or paid?
- If you typed a username and password, change that password right away and turn on two-step login.
- If you paid or entered a card number, call your bank or card company using the number on the back of your card.
- Report it at ReportFraud.ftc.gov. If you think someone stole your identity, go to IdentityTheft.gov for a recovery plan.
Help a parent spot it
A free package feels harmless, and most of the time the item is. Help your parent remember the one rule that matters here: never scan a code or call a number that came in a box you didn't order. If anyone asks for money for it, the answer is no.
Lock down your accounts
These go beyond any one scam. Do them once and most scams get much harder.
- Turn on two-step sign-in for your email and bank. A passkey or security key is safest; a code by text is better than nothing.
- Use a different password for every account. A password manager remembers them for you, or write them in a notebook kept locked in a safe.
- Freeze your credit at Equifax, Experian, and TransUnion. It's free, and it stops new accounts being opened in your name.
- Ask your phone carrier for a number lock or transfer PIN, so no one can move your number to their phone.
- Pick a family code word that's never been posted anywhere.
Questions people ask
Can I keep a package I didn't order?
Yes. The FTC says you're legally entitled to keep unordered merchandise as a free gift. You don't have to pay for it, and you don't have to return it.
Someone is asking me to pay for it. Do I have to?
No. By law, companies can't send you things you didn't order and then demand payment. The Postal Inspection Service says not to be talked into paying for it.
Is it dangerous to scan the QR code in the box?
It can be. The FTC says the code could take you to a phishing site that steals your information, or download harmful software onto your phone. Skip it.
How did they get my name and address?
The Postal Inspection Service says your personal information may have been compromised. That's why it's smart to change your shopping passwords and keep an eye on your credit report and card bills.