Got a package you never ordered? What a brushing scam is, and what to do next

There’s a box on your doorstep. It has your name on it. It has your address on it. It does not have your memory of ordering it.

Inside: a phone case for a phone you don’t own. Or a single silicone spatula. Nobody in the house admits to buying it. Your card statement is clean. And now you’re standing in the hallway holding a spatula, feeling faintly accused of something.

Deep breath. You are very likely looking at a brushing scam, and the first thing to know is that you have not been robbed. Nothing has been charged to you. Nothing will be.

It’s not quite nothing, either. Someone had your name and address and decided to use them. That deserves ten minutes of your attention, not a panic. Here’s the translation: what brushing is, why a stranger paid to ship you junk, and a keep-return-report checklist you can run through before bed.

What A Brushing Scam Actually Is

Brushing is a fake-review scheme with a side effect of free tat.

The verified-purchase loophole

Marketplaces like Amazon and eBay treat reviews from verified purchases as more trustworthy: reviews tied to a real order that really shipped to a real address. A seller can’t fake that from their sofa. They need a package that genuinely moves through a carrier network.

So they manufacture one. The seller (or a “review farm” working for them) creates a shopper account in your name, orders their own product, and ships it to your address. Once tracking shows “Delivered”, the account leaves a glowing five-star review, and the marketplace believes it, because a purchase happened and a package arrived.

You are the “buyer”. You just didn’t buy anything. The US Postal Inspection Service puts it bluntly: they write a fake review in your name.

Why the contents are so random

The product being reviewed doesn’t have to be the product you receive. Sellers post whatever is lightest and cheapest, hence the famously random contents: hair ties, ping pong balls, socks. The item is a prop. The review is the point.

Why Sellers Bother

The term comes from Chinese e-commerce slang for inflating sales figures. The business case is simple: fake five-star reviews push a product up the search results, and a higher ranking sells more units than the postage costs. USPIS names the real victim: fake reviews prompt other people to buy worthless stuff. You got a spatula; someone else got talked into a dud.

What It Says About Your Data (The Uncomfortable Part)

A brushing package means your name and address are in a dataset somewhere they shouldn’t be. The BBB calls this the serious problem behind the harmless-looking box: once the information is online, it can be reused for other schemes. Which? points to data breaches as a common source.

Now, the reassuring bit: names and addresses are, sadly, the least secret thing about you. They leak from breached retailers, public records and marketing lists. A brushing package is proof your details are floating around, not proof anyone has your bank login. Nothing was charged. It’s a nudge to tighten things up, and that’s the spirit in which to treat it.

Brushing 2.0: The Qr Code Trap

The classic brushing package was harmless junk. The current version sometimes isn’t, which is why the FTC refreshed its warning in August 2026.

Some mystery parcels now arrive with a card inside: “Scan to find out who sent this gift”, or “Scan to claim your prize”. The code leads to a fake website dressed up as Amazon, your bank or a government agency, which asks for a login or card number. Security people call it “quishing”, phishing by QR code, and the parcel is just an unusually expensive way to get the link in front of you.

The rule is one line long: do not scan anything that came in a package you didn’t order. If you already did and typed something in, change that password now and turn on two-factor authentication. Curiosity is exactly what the card is counting on.

Gift, Mistake Or Brushing? How To Tell Them Apart

Before you report anything, rule out the boring explanations. Amazon’s own guidance starts here: check with friends and family first, because a surprising amount of “unexpected package scam” panic turns out to be an aunt.

A gift may stay a mystery for a day or two around birthdays. A delivery mistake should go back or next door. A brushing package is the one where everything points at you and nobody claims it. One quick check settles most cases: look at your real list of orders, across every shop, not just the one whose tape is on the box.

The Keep, Return Or Report Checklist

The short version: you can keep it, you don’t have to return it, and reporting it is the one step that actually hurts the seller.

Can I keep it in the US?

Yes. Federal law (39 U.S.C. § 3009) says unordered merchandise may be treated as a gift: keep it, use it, bin it, with no obligation to the sender. The FTC puts it plainly: you don’t have to return things you didn’t order, and you don’t have to pay for them.

Can I keep it in the UK?

Since April 2025 the Digital Markets, Competition and Consumers Act 2024 says you may treat unrequested goods from a trader as an unconditional gift.

Can I keep it in Australia?

The ACCC says you don’t have to pay, with a twist: the business may collect the goods within three months (one month if you tell them in writing you don’t want them), after which they’re yours. Nobody is coming back for a spatula, but that’s the rule.

Can I keep it in Canada?

The BBB takes the same broad line: you owe nothing and don’t have to send it back.

Two caveats

If the label is clearly addressed to someone else, that’s a misdelivery, not a gift. Hand it back to the carrier or the neighbour.

Whether you should keep it is a separate question. You don’t know who sent it. Skin products, supplements, seeds and anything that plugs into a wall are a hard no. Hair ties are probably fine.

Should I return it?

You don’t have to, and returning it does nothing to stop the scam. If you’d rather not have it in the house, USPIS says an unopened package can go back in the mail marked “Return to Sender” at no cost. Opened and unwanted? Dispose of it. Never pay to ship it anywhere.

Who do I report it to?

This is the step that actually helps: marketplaces can only remove sellers they know about.

Step 1: The marketplace whose label is on the box

Amazon has a Report Unwanted Package form: it asks how many packages you received and for a tracking number from one of them. eBay and AliExpress have their own routes.

Step 2: Your national fraud reporter

US: ReportFraud.ftc.gov, and USPIS if the contents look dangerous. UK: Action Fraud (101 in Scotland). Australia: Scamwatch. Canada: the Canadian Anti-Fraud Centre.

Step 3: The review itself, if you can find it

The BBB suggests searching the product for a review under your name and flagging it. Optional, but satisfying.

The “Fake Tracking Number” Cousin

Brushing has a louder relative, and they get confused.

A fake tracking number scam is the text that says “Your package could not be delivered, click here to reschedule”, with a tracking number that looks about right. There is no package. The link is the product. USPS is explicit that it won’t text or email you unless you asked for updates on a specific tracking number, and that its messages never contain a link.

So: a real package you didn’t order is brushing. A fake package you’re told to chase is smishing. One shows up with a spatula; the other with a link. Don’t click. Paste the number into a tracker you already trust and see whether it exists at all. In the US, forward the text to 7726 and, for USPS impersonations, email [email protected].

How To Make This Never Happen Again

You can’t un-leak an address. You can make the leak useless.

• Change the password on your shopping accounts: Start with the marketplace on the label. The FTC recommends it even though the scammer’s account is separate.

• Turn on two-factor authentication: Amazon, eBay, PayPal and your email. Your email is the master key to everything else.

• Check for orders and accounts you didn’t open: The FTC suggests AnnualCreditReport.com in the US.

• Run your email through Have I Been Pwned: Which? 's tip: it shows which breach spilled your details.

• Keep one honest list of what you actually ordered: This is the quiet fix. When every order confirmation in your inbox is tracked automatically in one place, as Parcel Monitor does with Gmail, a mystery box is instantly identifiable as a mystery. No scrolling through five retailer apps at 11 PM.

• Be stingy with your address: Giveaways, “free sample” forms and quiz sites are where many of these lists start.

• Know your buyer protections: For the shopping you do on purpose, know what Amazon, PayPal and your card issuer will and won’t do. And if the box comes with a card, a link or a request for anything at all, treat it as the online shopping scam it is.

The Whole Thing On A Sticky Note

A brushing package is a cheap, unordered item shipped to your real address so a seller can post a fake verified-purchase review in your name; nobody charged you. It does mean your name and address have leaked, so change your shopping passwords. Rule out a gift or a misdelivery, then keep, bin or return the item as you like. Never scan a QR code from a box you didn’t order, never click a “reschedule delivery” text, and report the seller to the marketplace and your national fraud reporter.

So, What Now?

So, the spatula. It’s yours, or the bin’s. Nobody charged you. Nobody is coming to collect. A stranger spent a few dollars to borrow your name for a review, and you’ve just spent ten minutes making sure that’s all they get.

Change the password, skip the QR code, report the seller. Then get back to the packages you actually ordered.

Helpful Answers

What is a brushing scam?

A brushing scam is when a seller ships cheap, unordered items to a real address so they can post a fake “verified purchase” review in that person’s name. The package is a prop; the review is the goal.

Why did I get an Amazon package I didn’t order?

Most likely a third-party seller used your name and address to create a fake order and review. Check with family in case it’s a gift, then use Amazon’s Report Unwanted Package form. You don’t need to return it.

Can I keep a brushing package?

In the US, yes: federal law lets you treat unordered merchandise as a gift. The UK’s DMCC Act 2024 says the same. In Australia the business has up to three months to collect before it’s yours. Be cautious about using anything you can’t identify.

Is an unexpected package scam dangerous?

The package usually isn’t, but it means your name and address are circulating, and newer versions include QR codes leading to phishing sites. Don’t scan them, change your shopping passwords and watch your accounts.

Was my credit card stolen?

Almost certainly not. Brushing sellers pay for the item and postage themselves; they need your address, not your money.

How do I report a brushing scam?

Report the seller to the marketplace on the label, then to ReportFraud.ftc.gov (US), Action Fraud (UK), Scamwatch (AU) or the Canadian Anti-Fraud Centre. If it came through USPS and looks suspicious, contact the Postal Inspection Service.

What’s the difference between a brushing scam and a fake tracking number text?

Brushing is a real package you didn’t order. A fake tracking number text is a made-up delivery problem designed to make you click a link. Carriers don’t text you links out of the blue; check the number in a tracker you trust instead.

See every package you actually ordered, from every shop, in one timeline on Parcel Monitor. Free, always.