A brushing scam is a scheme in which someone sends you merchandise you never ordered, then uses your name and the delivery to make fake online reviews or sales activity look genuine. Some unexpected packages also contain a QR code that leads to a phishing website. Receiving a package does not, by itself, prove your shopping account was hacked.
Quick answer: Check whether the parcel is actually addressed to you and whether it could be a gift or household order. Do not scan an unknown enclosed QR code or pay to identify the sender. Review your shopping accounts and statements through the official apps or websites, then report an unexplained shipment to the marketplace.
Reviewed October 3, 2026. This guide draws on FTC, U.S. Postal Inspection Service and USDA guidance. It describes an established scam pattern, not a newly verified October outbreak.
How does a brushing scam work?
The U.S. Postal Inspection Service explains that a seller may obtain someone’s address online, send an inexpensive item and create a positive review in that person’s name. The shipment helps create the appearance of a genuine buyer. Inflated ratings can then mislead other shoppers.
You do not have to write a review, scan anything or pay for the scheme to involve your information. The fake activity may happen without access to your existing shopping account. A name and mailing address are personal information, but possession of those details does not prove the sender has your password, Social Security number or card details.
The FTC’s August 2026 brushing alert describes reports involving cheap, unexpected items and notes that packages can appear to come from a familiar marketplace. A company name on the box does not identify who actually arranged the shipment.
Is every unexpected delivery a brushing scam?
No. Use these checks before deciding what happened:
| What you find | Next step |
|---|---|
| Someone else’s name or address | Contact the carrier through its official channel about a mistaken delivery. Do not treat it as a free gift. |
| A household member or friend confirms an order | Verify the details with that person directly; it may be an ordinary purchase or gift. |
| An unfamiliar order or charge in your account | Report the transaction and secure the account. This needs attention beyond identifying a possible brushing shipment. |
| Your name, no known order and no matching charge | Brushing is one possibility. Preserve the label and ask the marketplace to investigate. |
| Only an unexpected shipping email, with no parcel | Verify it independently. The message alone does not establish brushing. |
For that last situation, our Best Mama Kitchen shipping-email guide explains why an unexpected notice can have several explanations. A suspicious email and a physical unsolicited package require different checks.
If the parcel or notice names Temu, our Temu scam-or-legit guide explains marketplace identity, order checks and return rules. A Temu label alone does not establish brushing or show who arranged the shipment.
What should you do after receiving an unordered package?
- Save the details. Photograph the shipping label, tracking number, item and any enclosed message. Keep those records for the marketplace or carrier; avoid posting your full address publicly.
- Open the real shopping app yourself. Review orders, payment methods and account activity. Use the platform’s own help menu to report an unsolicited package rather than the contact information on an unknown insert.
- Check your account security. The FTC recommends changing online-shopping passwords as a precaution. Use a unique password and enable two-factor authentication where available.
- Review financial activity. Check statements for unfamiliar charges and report them promptly to the issuer. If you find signs of identity misuse, review your credit reports and use IdentityTheft.gov for recovery guidance.
- Report suspected brushing. Tell the marketplace what arrived and explain that you did not order it. You can also submit a report at ReportFraud.ftc.gov.
Keep a record of what you actually observed. An unexplained parcel is worth reporting, but it does not justify accusing a named return-address business of fraud without further evidence.
What is the QR code version of brushing?
A card may say to scan a QR code to learn who sent the gift or obtain return instructions. The FTC’s package QR-code warning explains that the destination may seek passwords or payment information and can present malware risks.
Do not enter credentials or payment details to identify an unknown gift. Contact the retailer through an independently located official website or app. A QR code inside a parcel is not proof that its destination is trustworthy.
If you already scanned it, consider what happened next:
- Only viewed the code or opened a page: Close it. Scanning alone does not establish that every account or the entire phone was compromised.
- Entered a password: Change it through the real service, change it anywhere it was reused and enable two-factor authentication.
- Provided card information: Contact the issuer using its official app or the number on your card.
- Downloaded or installed something: Stop interacting with it, update your device and seek security guidance from the device or software provider.
Can you keep an unsolicited package without paying?
For U.S. consumers, the FTC’s unordered-merchandise guidance says a company cannot send merchandise you did not order and then demand payment. You generally do not have to return it and may keep it.
That guidance concerns genuinely unsolicited merchandise. It should not be used to claim a neighbor’s misdelivered parcel, ignore a known order or dismiss an unauthorized account transaction. Resolve those situations with the relevant carrier, retailer or issuer.
Keeping an item does not mean it is safe to use. Avoid consuming unknown products or using items whose safety or origin you cannot verify. USPIS advises seeking appropriate guidance for organic material or unknown substances.
For unsolicited seeds, USDA APHIS instructs recipients not to plant them and to keep the seeds and packaging for inspection. Report them to your State Plant Health Director and follow the agency’s handling instructions, rather than putting them in a garden or compost.
Brushing scam FAQs
Why is it called a brushing scam?
The scheme is intended to improve the appearance of a seller’s ratings and sales through fake customer activity. Sending an item can help make a fabricated transaction seem genuine.
Does a brushing package mean my identity was stolen?
It shows that someone used your delivery details, but does not prove full identity theft or an account takeover. Look for evidence such as unfamiliar orders, logins, charges or accounts opened in your name.
Can brushing happen without a QR code?
Yes. Fake-review brushing does not require you to interact with the package. A QR code can add a separate attempt to obtain sensitive information.
Do I have to pay for something I never ordered?
U.S. FTC guidance says companies cannot demand payment for genuinely unordered merchandise. Check first that it is not a household purchase, subscription you authorized or a mistaken delivery.
Should I contact the sender listed on the package?
Use the marketplace’s or carrier’s independently verified support channel first. The printed details may not identify the person responsible. Do not pay a fee or supply sensitive information to an unknown contact.
What if I ordered something but received cheap junk instead?
That may be a wrong-item or non-delivery dispute rather than ordinary brushing. Keep the packaging and order records, report the mismatch to the retailer or payment provider and ask your issuer about dispute deadlines.
Leave a Reply