That Package You Did Not Order Could Be a Scam

The Package Looks Harmless

A package you never ordered can look like a lucky mistake, especially when the box contains something cheap and random. The Federal Trade Commission says that unexpected delivery may instead be evidence that someone is using your name or address in a brushing scam.

In an Aug. 20 consumer alert, the FTC said recent reports involved items such as baby wipes, toothpaste or seeds. The package is addressed to a real person even though that person never placed the order.

The goal is often not the item in the box. It is the delivery record attached to it.

Why Scammers Send Something to Your House

In a brushing scam, a seller sends merchandise to someone who did not order it so the delivery can make that person appear to be a verified customer. The scammer can then use the recipient’s name to post a fake positive review and make the seller’s products look more popular or trustworthy.

The U.S. Postal Inspection Service says brushing scams are illegal in the United States and can involve third-party sellers that obtained a recipient’s address online. Cheap merchandise makes the scheme relatively inexpensive for the sender.

The unwanted delivery can also be a warning that personal information has already been exposed or collected.

The QR Code Can Create a Second Trap

The FTC warned that some packages now include a note with a QR code. The message may claim the recipient can scan the code to learn who sent the package or to start a return.

Instead, the code may direct the person to a phishing website designed to collect credit-card details, usernames or passwords. The Postal Inspection Service describes the same variation as “quishing,” or QR-code phishing.

That turns a strange package into a two-step scam: first, someone uses your information to create the delivery; then the note inside tries to get even more.

What the FTC Says to Do

The FTC recommends changing passwords on online-shopping accounts if an unexpected package arrives and checking credit reports for signs of identity theft. If the package came through an online marketplace, the agency advises contacting that platform so it can investigate the seller.

Consumers generally do not have to pay for unsolicited merchandise. The FTC also cautions against using an unknown product simply because it arrived for free.

The strongest warning is also the simplest: if you did not order the package, do not assume the QR code inside is there to help you.

References: That unexpected package you got could be a brushing scam | Brushing Scam

The Truth In Facts team was assisted by generative AI technology in creating this content