If a package you did not order arrives with your name and address, do not scan an enclosed QR code, call a number on the insert, or pay a return fee. First check whether it belongs to someone in your household, was sent as a gift, or matches an order in your real shopping accounts.
If none of those explanations fit, it may be an unexpected package scam known as brushing. The seller ships a cheap item so it can claim a completed delivery and post a fake review using the recipient's name.
Short answer
Do not interact with anything inside the package that asks you to scan, click, call, log in, or pay. Check your order history by opening the retailer's app or typing its website yourself. Change shopping-account passwords, contact the marketplace through its official support channel, monitor your credit, and report a suspected brushing scam to the FTC.
What is a brushing scam?
In an August 20, 2026 consumer alert, the Federal Trade Commission described a brushing scam as an unsolicited shipment used to create proof of delivery. The sender then uses the recipient's name to post a fake review and make its products or store appear more popular.
The package may look as if it came from a familiar marketplace or an unknown business. Recent FTC reports included inexpensive, random products such as baby wipes, toothpaste, and seeds.
The package itself does not establish how the sender obtained your address. The FTC says it could also be a sign that someone has, or is trying to steal, personal information. That possibility calls for account checks, not an assumption that identity theft has definitely occurred.
Brushing scam or normal delivery mistake?
An unfamiliar package can have an ordinary explanation. Check before labeling it a scam.
| Check | Possible delivery mistake or gift | Possible brushing scam |
|---|---|---|
| Order history | Matches an order under another household account | No matching order in any known account |
| Sender | Friend, relative, employer, or retailer confirms it independently | Sender is unknown or cannot be verified |
| Contents | Item you expected, a gift note, or a recognizable replacement | Cheap, random product with no explanation |
| Insert | Normal packing slip that matches the retailer's records | QR code, review request, return fee, or login prompt |
| Follow-up | Support message visible in the retailer's real account | Text or email pushes you to an outside link or phone number |
Ask other people in the household whether they placed the order. Open your shopping apps directly and review orders, archived orders, saved addresses, payment methods, and account messages. If the label names a marketplace, contact that company through the support page in its app or official website.
Do not scan the QR code in the package
The FTC says some brushing packages include a note with a QR code that claims to identify the sender or process a return. The code may lead to a phishing site that asks for a card number, username, or password.
A printed code is still a link. You cannot judge its destination by looking at the square pattern. Do not scan it to satisfy your curiosity, even if the insert uses a known retailer's logo.
The same rule applies to a phone number printed on the note. Search for the retailer's official support channel independently. If you receive a follow-up text or email, use our guide to check a link without clicking.
Secure your shopping accounts
The FTC recommends changing the passwords on all online shopping accounts after a suspected brushing scam. Use a unique password for each marketplace. If the same password was used elsewhere, change it on those accounts too, starting with the email account that receives password resets.
Then:
- Turn on multifactor authentication where the retailer offers it.
- Review recent orders, returns, saved addresses, payment methods, and logged-in devices.
- Remove unfamiliar addresses, cards, phone numbers, or sessions.
- Check the email account for password-reset or order messages you did not request.
- Contact the marketplace so it can investigate the shipment and seller.
If you find an unfamiliar charge, contact the card issuer or bank using the official app or the number printed on the card. Do not use contact information enclosed in the package.
Check your credit without assuming the worst
The FTC recommends checking your credit reports weekly for free at AnnualCreditReport.com. Look for accounts or inquiries you do not recognize.
An unexpected package alone does not prove identity theft. If you find an unfamiliar account, account opening, or other misuse, follow the FTC's recovery plan at IdentityTheft.gov.
What should you do with the item?
The FTC says you do not have to pay for merchandise you did not order or return it. Be cautious about using an unknown product because you do not know where it came from or how it was handled.
If the package contains food, medicine, cosmetics, seeds, chemicals, batteries, or another item that may require special handling, do not consume, plant, open, or dispose of it carelessly. Ask the carrier, marketplace, or relevant local authority for safe instructions through an independently verified contact.
Keep a photo of the shipping label and contents before discarding packaging. Do not publish your address, tracking number, account details, or other personal information when asking for help online.
How to report a brushing scam
- Report the seller and shipment to the marketplace through its official app or website.
- Report the incident to the FTC at ReportFraud.ftc.gov.
- Use your phone or email provider's reporting controls for follow-up phishing messages.
- Contact the bank or card issuer if you find an unauthorized charge.
- Use IdentityTheft.gov if the account review reveals identity theft.
If a follow-up message starts arriving after the package, see how to block scam texts and emails on iPhone after you have saved the evidence you need.
Frequently asked questions
Why did I receive a package I did not order?
It may be a gift, household order, shipping mistake, replacement item, or brushing scam. Check real order histories and ask the household before deciding.
Is a brushing scam identity theft?
Not necessarily. The sender has at least a name and delivery address, but the package alone does not prove that an account or identity was stolen. Check your accounts and credit for actual signs of misuse.
Should I scan the QR code to find the sender?
No. The FTC warns that a code in an unsolicited package can lead to a phishing site that steals login or payment information.
Do I have to return or pay for the item?
The FTC says you do not have to return or pay for merchandise you did not order. Use caution with the product because its source is unknown.
Can Rampart tell who sent the package?
No. Rampart works on suspicious SMS and connected email signals. It may help with a related phishing message, but it does not inspect physical mail or marketplace orders.
The safest next step
Skip the insert and check the accounts themselves. Change shopping passwords, contact the marketplace from its official app, review your credit, and report suspected brushing to the FTC.
For another warning layer around follow-up messages, see what Rampart's SMS and email filtering does.
Sources
- Federal Trade Commission, That unexpected package you got could be a brushing scam, August 20, 2026.
- Federal Trade Commission, ReportFraud.ftc.gov.
- Federal Trade Commission, IdentityTheft.gov.
- AnnualCreditReport.com, the federally authorized source for free credit reports.