Last checked . Picks are based on the prices, rates, fees and terms each provider publishes, checked at the source. We never rank products by commission. See how we’re funded.
Short answer: a package you never ordered, stuffed with something cheap, is often a brushing scam. You don’t have to pay for it or send it back. Change your shopping passwords, tell the marketplace it came from, and don’t scan any QR code inside. The FTC lays this out in an Aug. 20 consumer alert. Holiday deliveries are about to pick up, so more of these boxes are coming.
How a brushing scam works
The box looks like it’s from a known company like Amazon, or from someone you’ve never heard of. The FTC says recent reports describe “something cheap and random” inside, like baby wipes, toothpaste or seeds. Why send it? Scammers want “validation” of delivery, the agency says. Then they use your name to place fake reviews online and “brush up” their sales.
Red flags to check
| Red flag | What it can mean |
|---|---|
| A package you didn’t order | Your name and address may be on a seller’s list |
| A note with a QR code that says it will reveal the sender or handle a return | The code may lead to a phishing site that steals card numbers, usernames or passwords |
Source: FTC consumer alert, Aug. 20, 2026. The first row’s explanation is our reading of the FTC’s description.
What to do about a brushing scam package
Start with your passwords. The FTC says to change them on all your online shopping accounts in case they were compromised. If the package came from Amazon or another marketplace, message the platform so it can investigate removing the seller. Next, check your credit weekly for free at AnnualCreditReport.com and look for signs of identity theft. Finally, report the brushing scam at ReportFraud.ftc.gov.
Already scanned the code and typed in a password? Work through our recovery steps, in order. Our guide to scam messages explains the QR hazard.
What you don’t have to do
The FTC says the law doesn’t require you to return things you didn’t order. You don’t have to pay for them, either. It does urge caution about using the product: “After all, you don’t know who sent it.”
Editor’s take
A free box feels like luck. In a brushing scam, the harm isn’t the toothpaste. It’s the reviews posted in your name and the chance that your credentials get phished. Five minutes checking your accounts covers both.
