November 6, 2026
Updated: November 6, 2026
Why unordered packages arrive, what they do and don't prove about your data, what to do with the item, and what to do if a QR code is inside.
Mohammed Khalil
In brushing scams, a seller ships you something you never ordered so it can make you look like a verified buyer and post a fake review in your name. You don't owe anything, and U.S. law lets you keep the item. The package does mean someone has your name and address, so change your shopping passwords, check your credit, and report it to the marketplace and the FTC. If a QR code is inside, don't scan it: the FBI warns those codes can lead to phishing pages or malware.
Brushing is a fake-review scheme built on real deliveries. The seller sends a cheap product to a real person so the sale looks genuine, then posts a positive review as if that person had bought it. The review lifts the product's rating and sales numbers, which brings in real customers.
The FTC's August 20, 2026 alert says these packages usually hold something inexpensive, such as baby wipes, toothpaste or seeds. They may look like they came from a known company or from a sender you don't recognize. The U.S. Postal Inspection Service adds that there is often no return address, or the return address belongs to a retailer, and that the sender is usually an international third-party seller.
A note on brands: the companies whose names appear on these boxes are usually not behind the scheme. Amazon's help page says it prohibits third-party sellers from sending unsolicited packages. DeepStrike is not affiliated with Amazon, USPS or any agency named in this article; the links go to their official pages.
Brushing is unlawful in the United States, according to USPIS. Separately, the FTC's rule banning fake reviews, announced on August 14, 2024, took effect on October 21, 2024 and allows courts to impose civil penalties for knowing violations.
You are useful to the seller because you are a real person at a real address. The cost of a cheap item and shipping is small compared with what better ratings can bring in. In simplified form, the scheme runs like this:
Not every surprise box is a scam. Check the look-alikes first, because each has a different fix.
| What you see | Likely explanation | What to do |
|---|---|---|
| A friend or relative could have sent it | Real gift | Ask them. If it is a gift, keep it |
| The order appears in your own marketplace account | Someone may be using your account | Change the password, turn on two-factor authentication, tell the marketplace |
| Another person's name at your address | Misdelivery or a previous resident | Do not treat it as yours; on Amazon, contact Customer Service |
| Marked as a free sample, or a charity mailing asking for a donation | Legal mailing | You may keep it and owe nothing |
| Products keep arriving after a free trial | Possible subscription scam | Check the trial terms; contact your card issuer about charges |
| A bill or demand follows the item | Billing scam | Do not pay; dispute any charge |
| Cheap random item, no sender, possibly a QR code | Brushing is likely | Follow the steps below |
The rules on samples, charity mailings, free trials and billing come from the FTC's page on unordered products and charges you didn't expect. The advice for packages addressed to someone else comes from Amazon's help page.
The item itself is usually not the main problem. The concern is what the delivery says about your information, and official sources word this differently:
These fit together once you separate three things:
USPIS also lists real harms beyond your own data. Your fake review can lead other people to buy worthless products. In other cases, criminals use a person's address and account information to send merchandise there, then steal it before the resident can intercept it. USPIS adds that personal information obtained this way can feed other scams, which is why the checks below matter. For scale, see our identity theft statistics.
How common is brushing? We did not find a national count on the FTC, USPIS or FBI pages we checked on November 6, 2026. The FBI said on July 31, 2025 that the QR version is not as widespread as other fraud schemes, so treat it as a real risk rather than an emergency.
Work through these in order. None of them costs anything.
Yes, in most cases. The FTC says you don't have to return or pay for items you didn't order. The underlying statute, 39 U.S.C. 3009, says unordered merchandise sent through the mail may be treated as a gift, with no obligation to the sender. This is general information, not legal advice.
| What you have | What official guidance says | Source |
|---|---|---|
| Unopened, with a return address | You may mark it "Return to Sender" and USPS returns it at no charge | USPIS |
| Opened, and you don't want it | Throw it away, if that is safe | USPIS |
| Opened, and you want it | Keep it and owe nothing, but be cautious using it because you don't know who sent it | USPIS, FTC |
| Seeds or plants | Don't plant them. Report them and keep the seeds and packaging | USDA APHIS |
| Food, liquid or an unknown substance | Notify the proper authorities and follow their instructions | USPIS |
| Anything that looks dangerous | Isolate it, keep your distance, wash your hands and call Postal Inspectors | USPIS |
| A bill or a charge for it | Don't pay. Dispute a credit card charge in writing within 60 days of the first statement showing it | FTC |
The USPIS return option describes USPS mail. If another carrier delivered the box, you still have no duty to return it under the FTC's guidance. For anything suspicious, follow the USPIS suspicious mail instructions.
The best-known example dates to mid-2020, when people across the U.S. reported seed packets they had not ordered. In a statement reproduced in an August 2020 USDA newsletter, the department said it had no evidence the packets were anything other than a brushing scam. It still told recipients not to plant them, and said it would test the contents for anything of concern to U.S. agriculture or the environment.
That advice has not changed. USDA APHIS guidance, last modified April 23, 2026, says not to plant unsolicited seeds, to report them to your State Plant Health Director, and to seal them in a bag and freeze them until someone contacts you. APHIS also estimates that about one-third of the reported shipments turned out to have been ordered on purpose from overseas sites that looked American, so check your own order history first.
The newer version is more dangerous than the classic one, because it aims at your data rather than a review. Official warnings have tracked it since early 2025:
The trick works because the missing sender creates curiosity, and the code offers to solve it. An illustrative note, not a real one, might read: "A gift for you. Scan to see who sent it." You have no need to know who sent it, so you have no reason to scan. For how QR phishing works and how to spot it, read our guide to QR quishing and phishing. It is one form of social engineering, which relies on curiosity and urgency instead of a technical flaw.
Scanning does not automatically mean harm. What to do next depends on what happened after the scan, so match your situation to the steps below. These come from the FTC's guide on what to do if you were scammed and its malware guidance.
The official pages don't give separate steps for someone who scanned and did nothing else. As a precaution, we suggest closing the page, checking your phone for new apps or permissions, and reporting it.
In every case, report it. The FBI asks for the name of the person or company, the websites and contact methods used, and any apps you downloaded or gave permissions to.
No official opt-out exists on the pages we checked, and your address may stay public. You can still make the scheme less useful and limit the damage:
Brushing targets consumers, but the habit it exploits, scanning a code to find out more, can reach company accounts when the same phone is used for work. Packages can arrive at the office too.
The FBI's January 8, 2026 FLASH on Kimsuky shows the corporate form of the risk. It describes a North Korean state-sponsored group embedding QR codes in spearphishing emails to think tanks, academic institutions and government entities, moving the victim to a mobile device outside normal endpoint monitoring. That campaign used email, not packages, but the FBI's advice covers unsolicited codes from any source, explicitly including packaging. It also recommends:
Add one practical rule for mailrooms and reception: unexpected packages and QR cards get reported, not scanned. Then check that it works. A social engineering penetration test can show whether staff report a lure and how the security team responds. DeepStrike's penetration testing services include simulated social engineering attacks such as phishing, calling and baiting, scoped and authorized in advance.
Be alert, not alarmed. Someone has your name and address, which is often public information. It doesn't prove your accounts were hacked. Change your shopping passwords, check your credit, and report it. Take it more seriously if you find an order in your account, a charge you didn't make or a QR code.
It may be brushing, where a bad actor ships to a publicly available name and address. First ask friends and family whether it is a gift. If it isn't, use Amazon's report form and have a tracking number ready. Also check your own order history for anything you don't recognize.
No. The FTC says you don't have to return or pay for items you didn't order. If you are billed, don't pay, and dispute any credit card charge in writing within 60 days of the first statement showing it.
Usually you can't know. Amazon refers to publicly available names and addresses, and USPIS says sellers find addresses online. Officials also warn that scammers may obtain personal information in other ways, so treat the package as a reason to check your accounts.
The FTC's rule targets businesses and people who create or sell fake reviews, and its guidance says ordinary consumers cannot be liable under the rule for what they say in reviews. Ask the marketplace to remove any review posted under your name.
No. The FBI says not to scan QR codes from unknown origins. The code may lead to a phishing page or download malware. You don't need to know the sender to deal with the package.
Report each package to the marketplace with its tracking number, and report it to the FTC. Don't contact the sender. Packages may still arrive, because your address may remain public, but reporting gives the platform what it needs to act against the seller.
Treat an unordered package as a prompt to check your accounts, not as a crisis. Don't scan or pay, change your passwords, check your credit, and report it. If you run security for an organization and want to know how staff respond to a real lure, contact our team to discuss a scoped test.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
