Receiving a package you didn't order can be more than a simple shipping mix-up. Sometimes it's part of a brushing scam, where scammers use your name and address to create fake purchases and reviews. In other cases, unsolicited packages may include QR codes or instructions designed to lead you to phishing sites or other scams. If a mystery package arrives at your door, treat it as a sign to check your accounts, update your passwords, and stay alert for suspicious activity.
Have you ever received a package you weren’t expecting? It may have been missing a return address or simply listed a large retailer like Amazon. Inside was an item you didn’t order.
If this odd situation has a familiar ring, you were likely the target of a brushing scam.
Scoring free merchandise hardly sounds like a bad thing, but falling victim to a brushing scam means your address, and often your name, is already in the hands of bad actors. They may have even more of your personal details—ones that put you at a heightened risk for identity theft.
Earliest this year, the United States Postal Inspection Service issued warnings about this illegal scam. In the worst cases, these mystery packages come with a fake QR code that links to phishing websites designed to steal your personal information, or even malware that can infect your devices.
How brushing scams work
When a package you didn't order shows up at your door, sometimes the goal is relatively simple: a seller uses your name and address to create a fake purchase, allowing them to post a glowing "verified buyer" review and make their products appear more popular than they really are.
Other times, the package is used as a way to get your attention. Inside, you might find a QR code, registration card, or instructions encouraging you to take action. Following those instructions could lead you to a phishing website designed to collect personal information or install malware on your device.
Some scammers operate on a large scale, sending thousands of packages to people across the country. The items are often inexpensive and easy to ship, making the scheme worthwhile if it helps them generate fake reviews, drive sales, or trick even a small number of recipients into taking the next step.
What to do if you receive unsolicited merchandise
The Federal Trade Commission (FTC) says that you never have to pay for unsolicited merchandise, even if the sender reaches out to you.
You also don’t need to return unordered merchandise. If you don’t want the item, you can donate it or throw it away.
What you should do is take a few steps to protect yourself:
Review your accounts. It’s possible that the brushing scammers have access to one or more of your accounts. Make sure you don’t see any unfamiliar orders on the retail websites you use and look for charges you don’t recognize on your credit card or bank statements. Continue to review these accounts regularly.
Change your passwords. Immediately select new, strong, unique passwords for your e-commerce, bank, and credit card accounts. Set up two-factor authentication, or 2FA, whenever it’s available.
Check your credit report. Be sure you don’t see any strange activity or changes to your credit report. If you spot activity you don’t recognize, consider contacting the three major credit bureaus and freezing your credit, which prevents lenders from accessing your credit report.
What if there’s a QR code inside?
A QR code may seem harmless, but scanning the wrong one can send you to a phishing site or expose your device to malware.
If you find a QR code inside an unsolicited package, it's safest not to scan it at all.
If you do encounter a QR code elsewhere, keep these tips in mind:
Read the link. When you hover your camera over a QR code, a URL will likely appear. Make sure it looks like it’s for the business or organization you expected, and check for typos or misspellings. Be extra wary of shortened URLs, which cybercriminals tend to use.
Look for tampering. Before you scan a code posted in a public place, carefully examine it. Could it be a sticker covering a real code or other information? Legitimate businesses often laminate signage that contains QR codes or place them behind glass.
Check the source. If you receive an out-of-the-blue communication from a trusted company encouraging you to follow a QR code to make a payment or enter personal information, reach out to the company directly before taking action (be sure to check the company's official website for the correct contact information). The same goes if you get an unexpected QR code from a friend, as they could have been hacked.