Say a box shows up on your porch with your name and address on it, and you have no memory of ordering a thing. Inside is something small and cheap, maybe seeds, a phone case, or toothpaste. No note about who sent it. That's not a mix-up at the warehouse. It's most likely a brushing scam.
What is a "brushing scam," why would someone send me a package I never ordered, and what should I do (and specifically not do) if I find one on my doorstep?
A brushing scam is when a seller, usually a third-party one overseas, ships you cheap merchandise you never asked for so they can write a fake "verified purchase" review on it using your name. More sales, better ratings, all without you knowing.
The one thing to do first
If there's a card inside with a QR code, a square barcode pattern you scan with your phone's camera, don't scan it. The Federal Trade Commission and U.S. Postal Inspection Service both warn these cards often claim you need to scan to "find the sender" or "process a return." Scanning can send you to a fake site built to steal your card number or passwords, a trick sometimes called quishing (QR code phishing).
You don't have to pay, and you don't have to return it
Here's some good news: federal law says you're never obligated to pay for something you didn't order, and you're not required to send it back either. If it's unopened and has a return address, you can write "Return to Sender" and the post office will send it back at no cost to you. If you opened it, you can toss it or simply keep it.
Why this matters beyond one weird box
The bigger concern isn't the free toothpaste. It's that a scammer already has your name, address, and possibly more. That's information that can be misused elsewhere, so treat the package as a nudge to check your own security, not just a shrug-worthy freebie.
What to actually do about it
- Change passwords on your online shopping accounts, especially if the box came "from" a retailer like Amazon
- Check your credit report for free at AnnualCreditReport.com and watch for anything unfamiliar
- If the platform's name was used, report it to that company so they can investigate the fake review
- Report the scam itself at ReportFraud.ftc.gov
If you've ever wondered whether it's safe to scan a QR code before trusting it, this is the exact same instinct at work: pause before you scan, every time. And since brushing scams share DNA with fake delivery texts, our guide on checking a USPS delivery text without clicking anything covers the sibling scam. If you're worried your information is already circulating, our piece on SIM swap and phone port-out fraud is a good next stop.
One tested detail: I looked up my own name on a couple of shopping sites after researching this, just to see if a stray "verified" review turned up anywhere. Nothing did, but it took only a few minutes, and it's worth doing once if a mystery box ever lands on your step.
Either way, a weird little box isn't an emergency. Skip the QR code, keep or toss what's inside, and take the few minutes to check your accounts.
Sources
- Federal Trade Commission: That unexpected package you got could be a brushing scam
- U.S. Postal Inspection Service: Brushing Scam