Is this package you didn't order a brushing scam?
A box showed up with your name and address on it, but you never ordered anything. There is no return address you recognize, no invoice, sometimes no sender at all. Inside is something cheap and random: a seed packet, a phone case, a ring light, costume jewelry. Before your mind runs to the worst, take a breath. In most cases this is a brushing scam, and the package itself is not dangerous.
Here is what is actually going on, why your address is involved, and the small number of things worth doing about it.
What a brushing scam is
Some third-party sellers on online marketplaces inflate their ratings by creating fake “verified purchase” reviews. To make a review look verified, the platform needs to see a real order shipped to a real person. So the seller ships something cheap to a name and address they found or bought, marks the order delivered, and then posts a glowing review in that “customer’s” name. The product they review is often something far more expensive than the trinket you received.
You were not chosen because someone is watching you. Your name and address were on a list, likely gathered from a data broker, an old breach, or public records. That is unsettling, and it is worth tightening a few things, but it does not by itself mean your accounts are compromised.
Do not scan the QR code
The one variation that can hurt you is the insert. Some of these packages include a card with a QR code offering a “gift,” a refund, or information about the sender. Scanning it leads to a phishing page or a prompt to install something. Throw the card away without scanning. If you already scanned one and typed in details, our guide on what to do after scanning a scam QR code walks through locking the card and resetting logins.
You can keep it, and you owe nothing
Under U.S. federal law, merchandise sent to you that you never ordered is yours to keep. You do not have to pay for it, return it, or respond to anyone who contacts you about it. If someone calls or emails claiming you must pay for the item or send it back, that is a follow-up scam, not a real obligation. Keep it, donate it, or bin it.
Check the accounts that matter
Spend ten minutes ruling out the less common, more serious explanation: that the order was placed through your own account. Log in to the marketplace the package seems to have come from and look at your order history and saved addresses. If the order is genuinely not there, this was brushing, and you are done with the urgent part. If you find orders you did not place, change that password immediately, turn on two-factor authentication, remove any saved payment methods you do not recognize, and check your card statements. If your personal information looks misused beyond the address, IdentityTheft.gov will build you a recovery plan.
Report it, briefly
Reporting brushing takes minutes and helps the platforms and regulators see the pattern. Report the package through the marketplace’s own report form so they can act against the seller, file with the FTC at ReportFraud.ftc.gov, and if it arrived through the mail you can also notify the U.S. Postal Inspection Service. Do not leave a review of the item, even a warning; activity on the fake order is exactly what the seller wants.
When it is more than brushing
A single mystery package is almost always the end of the story. What deserves a closer look is what sometimes comes with it: a flood of packages, password-reset emails you did not request, or calls from a “refund department” about the delivery. Those are signs someone is working your identity, not just your address. Save the messages before deleting anything; our guide on preserving evidence covers how. And if real money has already moved because of a scam that started this way, our Investigation Help page explains the options, including when a case is large enough to bring in Rexxfield for court-grade work.
The package is the least important part of a brushing scam. Take the ten minutes to check your accounts, skip the QR code, and let the free junk be exactly that.
— Gus