A package shows up at your home that you never ordered. It may contain something inexpensive or completely random — toothpaste, seeds, a small gadget or another low-cost item.
It may seem harmless, but it could be part of what’s known as a brushing scam.
Brushing scams happen when online sellers send merchandise to people who never placed an order. The goal usually isn’t to steal money from the person receiving the package. Instead, the shipment creates a record of a completed delivery, which can then be used to help make fake online reviews appear legitimate.
According to the Federal Trade Commission, scammers may use the recipient’s name to post a positive review and make it appear that the review came from a verified customer.
Why would someone send you something for free?
For an online seller, positive reviews can make a product look more popular, trustworthy or established than it really is.
By sending an inexpensive item to a real name and address, a dishonest seller may be able to create the appearance of a legitimate transaction and use that transaction to support a fake review.
The package itself may have very little value. The value to the scammer is making their online business look more credible.
The QR code is where things can get more serious
Some unexpected packages now include QR codes with instructions to scan them to learn who sent the package, arrange a return or get more information.
That’s where a brushing scam can turn into something more dangerous.
The FTC warns that QR codes included with mystery packages may direct people to phishing websites designed to collect personal information, usernames, passwords or financial information.
If you receive something you didn’t order, don’t scan a QR code simply because you’re curious about where it came from.
Does an unexpected package mean your identity was stolen?
Not necessarily.
Receiving a brushing package doesn’t automatically mean someone has access to your bank account or has fully stolen your identity. But it may indicate that your name, address or other personal information is circulating somewhere it shouldn’t be.
That makes it worth taking a few precautionary steps.
If a mystery package arrives:
- Change the password on the shopping account connected to the retailer, if applicable.
- Review recent purchases and account activity.
- Report the package or seller to the retailer.
- Check your credit reports for accounts or activity you don’t recognize.
- Avoid scanning QR codes or following instructions included in the package.
The FTC also notes that you don’t have to pay for merchandise you never ordered.
A brushing scam may start with something as ordinary as a package on your doorstep. The safest response is simple: don’t let curiosity lead you into sharing information the sender didn’t already have.