That Unexpected Package Could Be a Brushing Scam

Written By Ashley Karr

An unordered delivery may be used to support a fake review—or to lure you into scanning a dangerous QR code.

An unexpected package can feel harmless, confusing or even mildly entertaining. Perhaps the merchant made a mistake. Perhaps someone sent a gift without including a name.

Sometimes, however, the delivery is part of a brushing scam.

In August 2026, the Federal Trade Commission warned that scammers may send inexpensive products to real people so they can claim a completed delivery and publish fake reviews in the recipient’s name. Some packages also contain a QR code that supposedly identifies the sender or begins a return. The code may instead lead to a phishing website designed to steal credentials or payment information.

If You Read Only One Thing

If a package you did not order contains a QR code or instructions, do not follow them. Check your accounts and contact the marketplace through its official website or application.

Your Action Steps

  1. Do not scan an enclosed QR code.

  2. Do not call a number or visit a website printed on the package insert.

  3. Check your shopping accounts independently for an unauthorized order.

  4. Review stored addresses, payment methods and recent account activity.

  5. Change the password if the account may be compromised or the password was reused.

  6. Enable multifactor authentication where available.

  7. Contact the marketplace through its official help system.

  8. Monitor your credit and financial accounts when the situation suggests identity misuse.

  9. Report the scam to the FTC.

What Is a Brushing Scam?

The name comes from the idea of “brushing up” a seller’s reputation or sales activity.

A dishonest seller obtains a real person’s name and mailing address, sends a low-cost item and receives delivery confirmation. The seller can then create a fake customer account or review that appears connected to a verified purchase.

The package may contain something random and inexpensive, such as household supplies, seeds or a small accessory. The recipient is not the seller’s customer in the ordinary sense. Their identity and address are being used to make the transaction look legitimate.

The Package May Be Only the Beginning

Receiving an unordered product does not automatically mean that a financial account has been taken over. Names and addresses can come from public records, data brokers, breaches, old mailing lists or other sources.

It does mean that someone has enough information to send something to you and may be attempting to use your identity in connection with online activity.

That is a reason to investigate—not a reason to panic.

Be Especially Careful With QR Codes

A QR code hides its destination until it is scanned. A card inside the package might say:

  • Scan to see who sent your gift

  • Scan to arrange a return

  • Scan to confirm delivery

  • Scan to claim a reward

  • Scan to contact customer service

The page may imitate a retailer or shipping company and ask you to sign in, enter a payment card, pay a small fee or download an application.

Do not use the code. Open the marketplace’s official application or type its known website into your browser. If the package displays a tracking number, enter it only on the carrier’s official site.

Check Your Shopping Accounts

Review recent orders on the major marketplaces and retailers you use. Look for:

  • Orders you did not place

  • Newly added addresses

  • Changes to your email or phone number

  • Unfamiliar payment methods

  • Archived or hidden orders

  • Messages sent to or from sellers

  • New subscriptions or memberships

If you find unauthorized activity, change the password immediately, secure the associated email account and contact the retailer’s fraud team.

Use a unique password. If the same password was used elsewhere, change it on those accounts as well, beginning with email and financial services.

Review Your Broader Identity Risk

The FTC recommends checking your credit reports when you receive a brushing package. Federal law provides access to free weekly online credit reports through AnnualCreditReport.com.

Also monitor the payment accounts connected to your major shopping platforms. A brushing scam does not always involve a charge, but unexpected activity should be investigated promptly.

If you discover evidence of identity theft, use IdentityTheft.gov to create a recovery plan.

Do You Have to Return the Item?

The FTC states that you do not have to pay for or return merchandise you did not order.

Be cautious about using an unfamiliar product. You do not know how it was made, stored or represented. If the package involves seeds, food, medicine, cosmetics or another potentially regulated item, follow relevant government guidance before opening or discarding it.

Why This Matters Before the Shipping Season

As more legitimate packages begin arriving, an unexpected delivery becomes easier to dismiss. Family members may assume someone else placed the order. QR codes and delivery messages may also feel more believable when the household is actively tracking multiple purchases.

Create one family rule now:

We verify unexpected packages through the official retailer or carrier. We do not use the instructions enclosed inside an unordered package.

You do not need to identify every version of the scam. You need a dependable verification process.

Resources Outside Haven Smith & Company

Haven Smith & Company Resources

Haven Smith & Company provides practical education, tools, and guidance to help individuals, families, professionals, businesses, and institutions organize, protect, and prepare their digital lives with confidence.

Ashley Karr
Next

Create a Digital Purchase Record Before You Need a Receipt, Return, or Warranty