Brushing scams: why you got a package you didn't order
Quick answer
A package you never ordered is likely a brushing scam: a seller ships you cheap items so they can post fake reviews under your name. Per the FTC, you don't have to pay or return it. Don't scan any QR code inside, change your shopping passwords and report it.
- Comes by
- Last updated
How it works
The FTC says a brushing scam starts with a package you didn't order. The name comes from 'brushing up' a seller's numbers: a shipped order can be used to post a fake review under your name.
Recent FTC reports say the packages usually hold cheap items such as baby wipes, toothpaste or seeds.
The risk isn't the item. Some packages include a note asking you to scan a QR code. The FTC warns that code can lead to a phishing site that steals card numbers or usernames and passwords, and could download malware onto your phone.
The fact that a stranger has your name and address is the part to take seriously. It may mean your details were exposed somewhere.
Red flags
- A package addressed to you that you never ordered
- Cheap or random contents: baby wipes, toothpaste, seeds
- A note or card with a QR code or link to 'claim', 'activate' or 'review' something
- No return address, or a sender you don't recognize
- A message asking you to contact the seller or confirm your delivery
What to do
- 1
Don't scan the QR code or contact the sender
The FTC warns that replying can lead to attempts to get more sensitive information, and a QR code can lead to a phishing site or malware.
- 2
Know you don't have to pay or return it
The FTC says you don't have to pay for or return things you didn't order. Be careful about using the item.
- 3
Change your shopping passwords
Update the passwords on your shopping accounts and turn on two-step verification where you can.
- 4
Check your credit reports
Look for accounts or inquiries you don't recognize, which can be a sign of identity theft. If you see any, go to IdentityTheft.gov.
- 5
Report it
Report the package at ReportFraud.ftc.gov. If it came through a marketplace, report the listing to that site as well.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
A seller can only ship a brushing package if they have your name and address, which come from data brokers, people-search sites and breached customer lists.
Serus finds where your phone number, address and email are listed on people-search sites and other data brokers and removes them, and alerts you when your details show up in a breach. That won't stop every message, but it leaves scammers with less to work from. If you clicked or shared anything, our guide on what to do after a data breach covers the next steps.
Frequently asked
What is a brushing scam?
A seller ships you an item you didn't order so they can post a fake review under your name and boost their sales, according to the FTC.
Do I have to return or pay for an unordered package?
The FTC says you don't have to pay for or return things you didn't order.
Is it dangerous to use the item?
The FTC says to be careful about using the item. Don't scan any QR code that comes with it.
Does it mean my account was hacked?
Not necessarily. But the FTC suggests changing your shopping passwords and checking your credit reports for signs of identity theft.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
