Call us at (877) 892-8249
A package shows up at your doorstep with your name and address, but you didn’t order anything. Perhaps it’s something lightweight and cheap, like a phone case or a trinket. Either way, you might wonder: “Who sent it and should I worry?”
Packages like this may be part of a brushing scam, and you can handle one with a few simple steps. Learn how brushing scams work, what to do if you get one, what to check afterward, and where to report it.
Key takeaways
- Most brushing packages are harmless on their own, and you don’t have to pay for one
- Don’t scan any QR code inside, even if the package looks like it’s from a trusted brand
- Someone has your name and address, so check your credit reports, shopping accounts, reviews, and passwords
- You can protect yourself with free steps like using strong passwords, two-step sign-in, and a credit freeze
- Report the incident to the FTC, the U.S. Postal Inspection Service, and the retailer or marketplace
Why did you get a package you didn’t order?
You may have gotten a package you didn’t order because a seller used your name and address in a brushing scam. In this scam, a seller finds your address online and ships an inexpensive item to someone who never asked for it.
The delivery makes you look like a verified buyer (someone who bought the item), which lets the seller post fake positive reviews in your name. Those reviews boost the product’s ratings and sales. Because the items cost so little to ship, sellers see the trick as profitable.1
How exposed is your personal information?
Take our free risk quiz to see where your data may be exposed online.
Take the Risk Quiz
Is a brushing scam dangerous?
A brushing scam is usually not dangerous on its own, because the package typically has something cheap and random.
The risk comes from anything extra inside. Some senders add a note or card with a Quick Response (QR) code that claims to show who sent the package or help you process a return. Don’t scan it, even if the package looks like it came from a brand you trust.
In March 2026, police in Wytheville, Virginia, warned about unexpected packages that looked like they came from Amazon and included a note urging people to scan a QR code.2 The FTC warns that scanning could lead to a phishing website (a look-alike site) built to steal information like your credit card numbers, usernames, or passwords.3
One woman told the Better Business Bureau (BBB) she scanned a code because she thought an unordered package of pasta was a gift from a friend. It led to a site that looked like Amazon, and she reported getting more scam emails than usual since.4
In each case, the sender already had a name and address to ship to. Here are a few ways senders may have gotten them:
Hackers may have taken them in a data breach (when criminals break into a company’s records)
Malware (harmful software) may have stolen your logins and opened the door to your accounts
Your details could sit on marketing lists that data brokers (companies that collect personal information and resell it) sell to businesses
Scammers use many paths, and this guide on how they steal identities covers more of them.
What should you do with the package?
You can keep the package or throw it away, but don’t pay for it. The law says you may keep items you didn’t order, and the FTC adds that you don’t have to return or pay for them. If the package isn’t open and has a return address, you can also mark it “Return to Sender,” and the U.S. Postal Service (USPS) will send it back at no charge.
What should you check afterward?
After a brushing package arrives, take these four steps:
Check your credit reports (records of your borrowing history). You can review them weekly for free at AnnualCreditReport.com. Watch for accounts or credit checks you don’t recognize.
Look for shopping or marketplace accounts you never opened. Search your email for sign-up messages from stores you don’t use.
Search for reviews posted in your name on the retailer’s site. If you find one you didn’t write, report it and ask the company to remove it.
Update the passwords for all your online shopping accounts. The FTC recommends this in case your information was compromised.
If you find a new account, learn what to do if someone opened a credit card in your name and see more signs your identity was stolen.
How exposed is your personal information?
A brushing package means someone already has your name and address, and that information may be showing up in more places than you realize, from data broker lists to past breaches. Take our free risk quiz to see where your personal information may be exposed online and get a clearer picture of your risk.
Take The Risk QuizHow can you protect your information going forward?
You can protect your information going forward with three steps:
Use strong, unique passwords. Aim for at least 15 characters, and try a passphrase (a series of random words) if a long password is hard to remember.
Turn on two-step sign-in. Also called two-factor authentication, it adds a second step, like a one-time code, so a hacker who steals your password still can’t get in. Start with your email and bank accounts.
Freeze your credit. A credit freeze blocks anyone from opening a new credit account in your name, and you can place or lift it at no cost. Contact all three bureaus (Equifax, Experian, and TransUnion) to set one up.
If you want extra help, OmniWatch offers dark web monitoring, which scans breach databases and the dark web (a hidden part of the internet where stolen data is often sold) for your personal information and alerts you if it finds a match. For more ways to stay safe, read how to protect your personal information.
Where do you report a brushing package?
You can report a brushing package in three places:
The FTC: Report it at ReportFraud.ftc.gov, the agency’s site for reporting scams
The U.S. Postal Inspection Service: File a report online at uspis.gov/report or call 1-877-876-2455
The retailer or marketplace: If the package came from Amazon, eBay, or another retailer, file a fraud report on that company’s website so it can investigate
Some contents call for extra care.
If the package holds seeds, don’t plant them. They can carry pests or diseases that threaten U.S. crops. Keep the seeds and their packaging, and report them to your State Plant Health Director at the U.S. Department of Agriculture (USDA).5
How is a brushing package different from a delivery text scam?
A brushing package arrives at your door, while a delivery text scam arrives on your phone as a deceptive text. A brushing seller wants to post a review in your name, but a text scammer wants your money or personal information.
Here are two common versions of these texts:
A fake USPS text claims your package needs a redelivery fee, then sends you to a phony tracking link that steals your payment information
A fake Amazon text warns about suspicious account activity or an unauthorized purchase, then pushes you to click a link that steals your login information
If you get a text like either one, skip the link. Then read the USPS texts scam check or the Amazon texts scam check to see what to look for. You can also verify your order or tracking number on the company’s official site.
Frequently asked questions
Do I have to pay for a package I didn’t order?
No, you don’t have to pay for a package you didn’t order, per the FTC. Don’t let anyone talk you into paying.
Can I keep it?
Yes, you can generally keep the package you didn’t order. The law says you don’t have to pay for it or return it. The FTC does say to be careful about using it, since you don’t know who sent it.
Is my identity stolen?
Your identity may not be stolen, but someone has your name and address. The FTC says the package can also signal that someone has, or wants, more of your personal information. Check your credit reports and accounts for anything unfamiliar.
Why do I keep getting packages?
You may keep getting packages because the same seller, or others, still have your name and address. The Postal Inspection Service says the sender is usually a third-party seller who found your address online. Report each one to the FTC and change your shopping account passwords.
Should I contact the seller?
No, don’t contact the seller. A note or QR code inside the package could lead to a phishing site built to steal your information. Report the package instead.
Should I tell Amazon?
Yes, you should tell Amazon if the package looks like it came from Amazon or another online marketplace. The FTC says messaging the platform lets it investigate removing the seller. You can also ask the company to remove any reviews posted in your name.
This guide is published by OmniWatch. Follow OmniWatch on Facebook for ongoing guidance on identity protection, digital safety, and scam awareness.
*Restrictions and exclusions apply, click here to read full details of insurance coverage.
Sources
U.S. Postal Inspection Service, “Brushing Scam.”
WVVA (Channel 6), “Wytheville police warn of brushing scam involving unexpected Amazon packages and QR codes.”
Federal Trade Commission, “That unexpected package you got could be a brushing scam.”
Better Business Bureau, “BBB Tip: Don’t scan QR codes on unexpected packages.”
U.S. Department of Agriculture, “Non-Compliant Seeds: What You Need To Know.”
U.S. Postal Inspection Service, “Report Suspicious Mail.”