Mystery packages
A Package You Never Ordered Showed Up at Your Door. Here's Why That Should Worry You
It's called a brushing scam. The free stuff isn't the problem — what the sender may know about you is.
A box arrives addressed to you. Inside: baby wipes, a tube of toothpaste, or a packet of seeds. You didn't order any of it. Maybe it looks like it came from a big online retailer; maybe the sender is someone you've never heard of.
The Federal Trade Commission says this is likely a brushing scam — and with holiday shopping season ahead, more mystery boxes will be landing on doorsteps.
Why would anyone send you free stuff?
According to the FTC, sellers do this to create proof that a delivery happened. They then use your name to post fake positive reviews of their own products, "brushing up" their sales numbers and ratings. The items are cheap and random on purpose: the package is a prop, not a gift.
The bigger concern: a brushing package can be a sign that someone already has your personal information — or is trying to get it.
Some packages include a note with a QR code that claims to reveal the sender or start a return. The FTC warns that scanning it could take you to a phishing site built to steal card numbers, usernames or passwords.
Do you have to send it back or pay for it?
No. The FTC points out that the law says you don't have to return merchandise you didn't order, and you don't have to pay for it either. But be careful about using the product, since you don't know who sent it.
Don't scan any code that comes in the box. Mystery QR codes are showing up in more and more scams, from packages to fake stickers on parking meters. And be wary of texts that follow, like the fake delivery messages that spike every holiday season.
What to do if you get a package you didn't order
- Change the passwords on your online shopping accounts in case one was compromised.
- If it came through Amazon or another marketplace, message the platform so it can investigate the seller.
- Check your credit reports for free at AnnualCreditReport.com and look for signs of identity theft.
- Report the brushing scam at ReportFraud.ftc.gov.