Help NowStart Practice

Scam alert

A Package You Did Not Order? What a Brushing Scam Is

Published · Updated · Arrives by a delivery to your door

The short answer

You may keep an item you never ordered—the law does not require you to pay for it or send it back. The part worth avoiding is the note or QR code that asks you to scan to find out who sent it or to arrange a return, because that code can open a page built to collect sign-in details or card numbers. Change the password on your online shopping accounts, and tell the marketplace the package came from.

What is happening

The Federal Trade Commission reported in August 2026 that people are receiving small, random parcels they never ordered—baby wipes, toothpaste, seeds. The sender is usually a seller who wants to post a review in your name, which is why it is called brushing. Recent reports add a newer twist: a slip inside with a QR code and a friendly reason to scan it. Law enforcement in the Rochester, New York area described the same deliveries reaching households there in September 2026, and the pattern is being reported nationally.

How to recognize it

  • The parcel arrives addressed to you, but nobody in the household ordered it.
  • What is inside is cheap and unrelated to anything you buy.
  • A note invites you to scan a QR code to see who sent the gift or to start a return.
  • There is no receipt, no invoice, and no way to contact a real seller.
  • A review you did not write later appears under your name on a shopping site.

What to do instead

  1. Do not scan a QR code that arrives inside an unexpected package.
  2. Keep the item or throw it away. You are not required to return goods you did not order.
  3. Change the password on the shopping accounts you use, in case one of them is involved.
  4. Report the package to the marketplace it shipped from so it can look into the seller.
  5. Check your credit reports for free at AnnualCreditReport.com and look for accounts you do not recognize.

If it already happened

Responding to one of these is common and understandable. These steps are what people usually take next.

  1. If you scanned the code and signed in on the page that opened, change that password now and turn on two-step verification for the account.
  2. If you entered card details, contact the card company using the number on the back of the card.
  3. Review recent orders and saved addresses on your shopping accounts.
  4. Report it to the FTC. Reporting helps, and it costs nothing.
Open Help Now

Common questions

Do I have to send back a package I did not order?
No. Under federal law, merchandise that arrives unordered is yours to keep, and no one may bill you for it.
Is the package itself dangerous?
The contents are usually ordinary low-cost goods. The risk is in the QR code or web address that comes with it, not in the item.
How did they get my name and address?
Names and addresses circulate widely from data breaches and public records. Receiving one of these parcels does not mean your accounts were broken into, though changing shopping passwords is still a sensible precaution.

Practice this safely

Practice noticing when a message wants you to open something quickly, and choosing the independent check instead.

Every story is fictional. There is no timer, no score, and no real message, payment, or account.

Start the four-story practice

Where this comes from

These links open the published sources in a new tab. The destination is shown before you open it.

The full guide on this

More recent alerts

This alert provides general educational information drawn from the sources above. It cannot determine whether a specific message you received is genuine, investigate an incident, or promise recovery or reimbursement.