Got a Package You Didn’t Order? How to Handle a Brushing Scam Safely

• An unexpected package may be a brushing scam designed to create fake reviews or confirm that your personal information is active.
• Don’t scan enclosed QR codes, contact the sender, pay for the item, or use an unknown product. Change shopping-account passwords and check your statements.
• U.S. consumers can report the incident to the FTC and review their credit through AnnualCreditReport.com. Canadians can report it through the National Fraud Reporting System.

What an unexpected package could mean

If a package arrives in your name but you didn’t order it, don’t assume it’s a harmless free gift. It may be a brushing scam, in which a seller sends a low-cost item to a real address and then uses the delivery to create fake reviews or make a marketplace account look more legitimate.

The package can also be a warning that someone has access to an online shopping account, your address, or other personal information. In some cases, it may simply be a gift, a household purchase you forgot about, or a delivery sent to the wrong address. The safest approach is to treat it as unverified until you know where it came from.

The most important distinction is this: receiving an unordered item is different from authorizing a purchase. In the United States, federal consumer guidance says you generally do not have to pay for or return merchandise you did not order. That does not mean you should interact with the sender, scan a code, or use the product.

First, avoid the traps inside the package

Some brushing deliveries include a card or note that tells you to scan a QR code to identify the sender, claim a reward, or arrange a return. That code may lead to a phishing website designed to collect your card number, shopping password, or other login details. It could also direct you to a malicious download.

Do not scan the QR code, call a phone number printed on the insert, reply to a message from the sender, or visit a website by typing the address from the package into your browser. If you need to verify a delivery, open the shopping company’s official app or type its known website address yourself.

Be cautious with the product, too. An unfamiliar cosmetic, supplement, electronic device, food item, seed packet, or children’s product may be counterfeit, contaminated, unsafe, or simply not suitable for use. Keep the packaging while you document what happened, but don’t eat, apply, plant, plug in, or otherwise use an unknown item.

What to do after receiving an unordered package

1. Photograph and document it

Take pictures of the shipping label, tracking number, sender information, enclosed note, QR code, and the product. Record the date it arrived. This gives you useful evidence if the package is connected to account abuse, identity theft, a dangerous product, or a marketplace listing.

Don’t post a photo publicly with your full address, phone number, order number, or barcode visible. Crop or cover those details before sharing anything online.

2. Check your shopping accounts

Sign in through the official app or website for Amazon, Walmart, eBay, Temu, Etsy, or any other marketplace you use. Review recent orders, saved addresses, payment methods, new devices, account messages, and reviews posted under your name.

If you see activity you don’t recognize, change the password immediately and turn on two-factor authentication if the service offers it. Use a new password that you do not reuse elsewhere. Contact the marketplace through its official support channel and ask it to investigate the order or seller.

If the package appears to be connected to a shopping account, changing that account’s password is more urgent than trying to identify the sender.

3. Review bank and card activity

Check your credit card, debit card, bank account, and payment-service statements for unfamiliar charges. A brushing delivery itself may not involve a charge, but the same exposed information could be used for unauthorized purchases, recurring subscriptions, or account changes.

If you find a transaction you did not authorize, contact the financial institution using the number on your card or statement—not a number from the package, text message, or email. Ask what steps are available to block the card, dispute the transaction, or secure the account.

4. Check your credit file when the situation suggests identity risk

One unexpected package does not prove that someone opened credit in your name. Still, checking your credit report is sensible if you also notice unfamiliar shopping-account activity, strange emails about new accounts, missing mail, unauthorized charges, or other signs that your information may have been misused.

U.S. consumers can request free credit reports through the federally authorized AnnualCreditReport.com service. Look for accounts, hard inquiries, addresses, and collections you don’t recognize.

Learn how to place a U.S. credit freeze or fraud alert ↗
Get free U.S. credit reports through AnnualCreditReport.com ↗

Canadians should review reports from both Equifax and TransUnion. The Government of Canada recommends contacting both bureaus to report suspected fraud and request a fraud alert when appropriate.

Read the Government of Canada credit report and fraud guidance ↗

Should you return the package or pay for it?

For U.S. consumers, the FTC says you generally do not have to pay for unordered merchandise or return it. A seller cannot create a debt simply by mailing you something you never agreed to buy.

That rule does not mean every package should automatically be kept or used. If the item is hazardous, leaking, damaged, suspicious, or addressed to someone else, avoid handling it further and contact the delivery company or local authorities for guidance. If it is an ordinary, unopened product addressed to you, keep the documentation and avoid communicating with the sender.

Canada does not have an identical single federal rule covering every unordered delivery in the same way, so the safest practical response is to avoid payment or contact until you verify what happened. If a company demands money, threatens collections, or claims you agreed to a subscription, contact your financial institution and report the incident through the Canadian reporting system.

What if you already scanned the QR code?

Your next step depends on what happened after the scan.

• You scanned but entered nothing: Close the page, do not download anything, and delete the browser tab. Keep your phone and apps updated.
• You entered a password: Change that password immediately from the genuine service’s app or website. Change it anywhere else you reused it, and turn on two-factor authentication.
• You entered card or bank information: Contact the financial institution using a trusted number and ask about blocking or replacing the account or card.
• You downloaded an app or file: Disconnect the device from sensitive accounts if possible, remove anything you do not recognize, update the operating system, and consider contacting a qualified technician or the device manufacturer.

If you provided personal information or see signs of identity theft, use the official U.S. identity-theft recovery service or the Canadian reporting process rather than replying to the sender.

Use IdentityTheft.gov for a U.S. identity theft recovery plan ↗

How to report a brushing scam in the United States and Canada

United States

Report the incident to the Federal Trade Commission, especially if the package included a phishing QR code, fake review request, suspicious seller information, or signs that your personal information was misused.

If the package came through a marketplace, report the seller or suspicious review through the marketplace’s official support tools as well. Save screenshots before the listing or message disappears.

Canada

Canadian residents can report fraud or cybercrime through the National Fraud Reporting System, even if they did not lose money. The Canadian Anti-Fraud Centre says reports help law enforcement identify links between incidents and track emerging fraud patterns. If money or personal information was involved, contact your financial institution and local police as well.

A simple decision rule

Use this checklist before doing anything with an unexpected delivery:

1. Did I or someone in my household actually order it?
2. Does the official shopping account show a matching order?
3. Is there an unfamiliar QR code, payment request, return instruction, or urgent message?
4. Do my bank, card, or credit reports show anything unusual?
5. Does the item look unsafe, counterfeit, damaged, or intended for someone else?

If you cannot verify the source, do not scan, pay, return, or use the product. Document it, secure your shopping accounts, check for unauthorized activity, and report the incident through the appropriate official channel.

Helpful Links

• Federal Trade Commission brushing scam guidance – Explains how unexpected packages can be used to create fake reviews and lists recommended safety steps.
• AnnualCreditReport.com – Request and review official U.S. credit reports from the three nationwide credit reporting agencies.
• IdentityTheft.gov – Create an identity-theft report and receive a personalized recovery plan from the FTC.
• FTC ReportFraud.gov – Report brushing scams, phishing attempts, identity theft concerns, and other fraud in the United States.
• Government of Canada credit report and fraud guidance – Learn how Canadians can check both credit reports, dispute errors, and request fraud alerts.
• Canadian Anti-Fraud Centre reporting service – Report fraud or cybercrime online to Canada’s National Fraud Reporting System.
• Credit Freezes and Fraud Alerts – Official page referenced in the article.

Frequently Asked Questions

Q. Can I keep a package I never ordered?

A. In the United States, the FTC says you generally do not have to pay for or return unordered merchandise. You should still avoid using an unfamiliar product and keep the packaging in case you need to document a scam or safety concern. Canadian rules can differ, so avoid paying or contacting the sender until you verify the situation.

Q. Is every unexpected package a brushing scam?

A. No. It could be a gift, a forgotten household order, a replacement shipment, or a delivery error. It becomes more concerning when the package includes a QR code, asks you to contact an unknown sender, appears in an account you did not use, or arrives alongside suspicious account or financial activity.

Q. What if the package was delivered to my address but has another person’s name?

A. Do not open or use it. Follow the carrier’s official process for misdelivered mail or packages, using contact information from the carrier’s known website rather than a label insert or text message. If the package looks dangerous or suspicious, contact the carrier or local authorities.

Q. Do I need to freeze my credit after one unexpected delivery?

A. Not automatically. A credit freeze or fraud alert is more appropriate when you find unfamiliar accounts or inquiries, lose identity documents, provide information to a scammer, or see other evidence of identity theft. Review your credit reports first and contact the relevant credit bureaus or financial institutions if something is wrong.