An unexpected package can create a strange mix of curiosity and concern. Maybe you receive a cheap household item, a product you do not recognize, or a package addressed to you that nobody in the household ordered.
According to the FTC Consumer Alert published August 20, 2026, that package could be part of a brushing scam.
The good news is that receiving the package does not automatically mean your bank account has been compromised. But it does mean someone used your name and address without your permission. That is worth taking seriously and addressing calmly.
What happened?
A brushing scam begins when a seller or third party sends merchandise to your address even though you never ordered it. The item is often inexpensive, random, or unfamiliar. It may be a household product, personal-care item, seeds, or another low-value product.
The sender’s goal is usually not to give you a gift. The package creates a record that appears to show a real purchase and delivery. Once the order is marked as delivered, the seller may use your name to post a fake “verified purchase” review online.
That false review can make the seller’s listing appear more trustworthy. Higher review counts and ratings may help the seller attract legitimate customers.
The package is the “brush” used to improve the seller’s reputation.
Who is targeted?
A brushing scam can affect anyone whose name and address appear in a leaked or misused database. You may be targeted because your information was exposed through:
- A data breach
- An online purchase or account
- A loyalty program or mailing list
- A public record or data broker
- A compromised shopping account
- Another form of unauthorized information sharing
You do not have to be an active online shopper to receive one.
Why it matters
The item itself may have little value. The more important issue is the personal information behind the delivery.
Someone who did not have your permission had enough information to send merchandise in your name. That does not tell us exactly how they obtained it, or whether they accessed your financial accounts. It does tell us that your information may be circulating beyond the places you intended to share it.
That creates several risks.
Your information may be used again
A name and address can be combined with other details to support more convincing fraud. Additional information might include an email address, phone number, account username, or partial payment details.
A follow-up scam may be coming
The unexpected package may be only the first contact. Afterward, a scammer could send a text, email, or phone call pretending to represent a delivery service, retailer, payment department, or law enforcement agency.
They may claim that:
- A delivery problem requires your payment information
- You must confirm your identity
- The package contained an illegal or restricted item
- You need to pay a return or customs fee
- Your account will be closed unless you act immediately
These messages are designed to turn your curiosity into a rushed decision.
What we do not know yet
An unexpected package is a warning sign, but it is not conclusive proof of a specific data breach or identity theft.
You may not know:
- Which company or database exposed your information
- Whether the sender has your email address or phone number
- Whether your shopping accounts were accessed
- Whether a fake review was posted using your name
- Whether the package was sent as part of a broader fraud campaign
Do not spend hours trying to identify the sender or contacting an unfamiliar business. That interaction may expose you to additional phishing attempts.
Instead, focus on the steps that reduce your financial and privacy risk.
What should you do next?
1. Do not scan a QR code
An unsolicited package may include a note or card with a QR code. It may say the code will identify the sender, arrange a return, track the package, or provide a refund.
Do not scan it.
A QR code can direct your phone to a phishing website that attempts to collect your credit card number, password, login information, or other sensitive data. It may also try to persuade you to download unsafe software.
If you already scanned the code but did not enter information, close the page and avoid downloading anything. If you entered a password, change it immediately anywhere you used it.
For more guidance, review the FTC’s resource on how to recognize and avoid phishing scams.
2. Do not pay or respond
You do not need to pay an invoice connected to merchandise you never ordered. Do not call a phone number in an enclosed note, reply to a follow-up message, or provide personal information to “verify” the delivery.
If a later message creates urgency, treat that as a warning sign. Contact a company through a website or phone number you locate independently, not through the package or message.
3. Secure your online shopping accounts
Change the passwords for your shopping, payment, and email accounts. Use a different password for every important account.
Enable multi-factor authentication wherever it is available. This creates an additional barrier if someone has obtained your password.
Start with:
- Your primary email account
- Online shopping and marketplace accounts
- Banking and payment accounts
- Mobile phone or cellular account
- Cloud storage and social media accounts
4. Check your credit reports
Review your credit reports for accounts, inquiries, or addresses you do not recognize. You can obtain free reports through AnnualCreditReport.com.
A brushing scam does not necessarily involve a new credit account. Still, checking your credit is a sensible way to look for related identity theft.
Also review:
- Bank and credit card statements
- Digital payment accounts
- Shopping order histories
- Email account security notifications
- Mobile phone account activity
Consider placing a fraud alert or security freeze if you find signs of identity theft. The FTC’s identity theft guidance explains the recovery process.
5. Report the scam
Report the incident to the FTC at ReportFraud.ftc.gov.
If the package appears connected to an online marketplace, report it through the platform’s official customer support or seller-reporting process. The platform may be able to investigate fake reviews or misuse of customer information.
Keep photographs of the package, shipping label, enclosed note, and QR code. Do not scan the code to preserve evidence. Write down when the package arrived and whether anyone contacted you afterward.
Can you keep the package?
Generally, federal law says you do not have to return merchandise you did not order, and you do not have to pay for it. The FTC explains the rule in its guidance on unordered products and bills.
However, keeping the item does not mean you should automatically use it. You do not know where it came from, whether it is counterfeit, or whether it could be unsafe.
Do not:
- Pay for the item
- Return it using instructions from an unknown sender
- Scan a QR code
- Post a review
- Contact the sender directly
- Give the sender your name, address, account number, or identification
If you already shared information
If you scanned a QR code and entered financial information, contact the card issuer or financial institution using the number on your statement or card. Explain what happened and ask what protective steps are appropriate.
If you entered a password, change it immediately. Change it anywhere else that password was reused. If your email account was involved, review forwarding rules and recent login activity.
If you provided your Social Security number or other identity information, use the FTC’s identity theft recovery resources and consider a credit freeze with each major credit bureau.
The goal is not to panic. It is to limit the damage while the information is fresh.
The bottom line
A package you did not order may be part of a brushing scam. The sender may be trying to create a fake verified purchase and improve a product listing, but the incident also suggests that your name and address were obtained without your permission.
You may never learn exactly where the information came from. You can still take useful action: do not scan QR codes, do not pay, secure your accounts, review your credit and financial activity, save the evidence, and report the incident.
For more practical guidance on protecting your money and personal information, explore the Ask The Money Coach financial education resources and financial coaching services.
Frequently Asked Questions
Is receiving an unexpected package always a brushing scam?
No. A package may be a gift, a shipping error, or a purchase made by someone in your household. But an unfamiliar item addressed to you, especially one containing a QR code or review request, deserves caution.
What is the purpose of a fake verified purchase?
A fake verified purchase can make a review appear more credible. Sellers may use these false reviews to improve a product’s ratings and attract legitimate buyers.
Does a brushing scam mean my bank account was hacked?
Not necessarily. The sender may have only obtained your name and address. Still, you should review your financial accounts and credit reports for unfamiliar activity.
Should I contact the sender to ask why the package arrived?
No. Contacting an unfamiliar sender may confirm that your address is active or expose you to follow-up fraud. Report the package through official channels instead.
What if the package contains food, cosmetics, or medicine?
Be cautious about using or consuming products from unknown senders. The item could be counterfeit, contaminated, expired, or otherwise unsafe.
What if I scanned the QR code?
Close the website and do not download anything. If you entered a password, change it immediately. If you provided payment or identity information, contact the affected institution and monitor your accounts.
Can I throw away the package?
Yes. Before discarding it, consider photographing the label, contents, and any enclosed materials. Preserve evidence if you plan to report the incident.
How often should I check my credit after a brushing scam?
Check your credit reports and financial accounts promptly, then continue monitoring them. The FTC directs consumers to AnnualCreditReport.com for free credit reports.
Should I place a credit freeze?
A credit freeze can help prevent new creditors from opening accounts in your name. It may be appropriate if you find signs of identity theft or believe more sensitive information was exposed.
Where should I report a brushing scam?
Report it to the FTC at ReportFraud.ftc.gov. You can also notify the online marketplace involved through its official reporting process.
Avoid This Scam™ is the consumer protection and scam awareness desk of AskTheMoneyCoach.com. We help readers recognize, avoid, and respond to financial scams, fraud, identity theft, deceptive business practices, and online threats.
Our coverage includes scam alerts, fraud prevention strategies, consumer advocacy, practical safety guides, and expert analysis designed to help individuals and families protect their money, personal information, and financial well-being. We also explain what to do if you’ve already been targeted, because knowing how to respond can be just as important as avoiding a scam in the first place.
