Have you ever received a package at your home that you didn’t order? While it may seem like a harmless mistake—or even a free gift—it could be part of what the Federal Trade Commission (FTC) calls a “brushing scam.”

Understanding how these scams work can help you protect your personal and financial information.

What Is a Brushing Scam?

A brushing scam occurs when someone sends merchandise you never ordered, often an inexpensive item, using your name and address. The sender may then use your information to create fake online reviews or transactions that make a product or business appear more popular and legitimate than it actually is.

Receiving the package does not necessarily mean your financial accounts have been compromised, but it can be a sign that some of your personal information is already accessible to scammers.

Be Especially Careful With QR Codes

Some unexpected packages may contain a note or card with a QR code, encouraging you to scan it to find out who sent the package, confirm delivery, or process a return.

Do not scan an unexpected QR code.

The code could direct you to a fraudulent website designed to steal sensitive information, including your passwords, credit card numbers, or other personal and financial details.

What Should You Do If You Receive a Package You Didn’t Order?

If an unexpected package arrives at your home:

• Do not scan QR codes or click links included with the package.
• Change your passwords for online shopping accounts, particularly if the package appears connected to a retailer or online marketplace you use.
• Review your accounts and credit report for purchases, accounts, or other activity you don’t recognize.
• Don’t pay for or return unordered merchandise. Under federal law, you generally aren’t required to pay for merchandise you did not order.
• Use caution with the item itself. If you don’t know where it came from or who sent it, consider avoiding its use.
• Report suspected fraud to the FTC at ReportFraud.ftc.gov.

Stay Alert and Protect Your Information

Scammers are constantly finding new ways to make fraudulent messages, websites, and packages appear legitimate. An unexpected delivery may seem harmless, but it is always worth taking a moment to verify before scanning a QR code, clicking a link, or providing personal information.

When in doubt, don’t scan, don’t click, and don’t share.

Staying informed is one of the simplest ways to help protect yourself, your accounts, and your personal information from fraud.