An unexpected package arrived: brushing scam, fake review, or a mix-up?
An unsolicited package is not proof your identity was stolen. Learn how to distinguish brushing from a mix-up, check accounts safely, and avoid QR-code and return-fee traps.
A box turns up with your name on it, but you did not place the order. That is unsettling—and the internet quickly offers a dramatic explanation. The more useful first step is to separate what you know from what you do not. An unsolicited package can be a shipping mistake, a gift, an order placed by someone in your household, or part of a “brushing” scheme in which a seller sends low-cost goods to create a verified-looking review. The package by itself does not prove that your identity or payment account has been stolen.
The Federal Trade Commission published a consumer alert in August 2026 explaining that an unexpected package may be connected to brushing: a seller uses a real delivery to create a fake review or show that an order was fulfilled. The FTC advises contacting the marketplace if the parcel came from Amazon or another platform so it can investigate the seller and review. That is a specific pattern, not proof that every surprise parcel has the same cause.
What “brushing” means in plain language
A seller or someone acting for the seller sends a product to a real address, often using a real recipient name. The seller may then publish a review under a real-looking buyer profile to make the product appear more popular. The delivery can be genuine even though the recipient never knowingly ordered it. This is different from a fake delivery text that asks you to enter card details, although both can exploit the expectation that a parcel deserves a quick action.
Because an actual item may be delivered, a carrier tracking page can say “delivered” without answering who ordered it or why. Do not treat the shipping label, QR insert, or a stranger’s explanation as authentication. The source of the order matters more than the fact that a parcel exists.
A calm first-hour checklist
| Check | What to do | What it tells you |
|---|---|---|
| Household and gifts | Ask people who may share the address, including family or an office mailroom. | Rules out ordinary surprises or a delivery handed to the wrong person. |
| Marketplace account | Open the retailer app directly and review recent and archived orders. | Shows whether your account placed an order; do not use a link from the package. |
| Payment activity | Check bank and card statements from the official app or website. | Helps identify an unauthorized charge without exposing details to an insert or caller. |
| Package contents | Keep the label and packaging; photograph them if useful. Do not scan codes or install apps. | Preserves evidence while avoiding an unnecessary link or download. |
| Marketplace report | Use the platform’s help or report flow reached from its official site. | Lets the marketplace investigate the seller and, if applicable, the review. |
What a QR code or “return” insert changes
A QR code is simply a way to open a destination. It does not prove who created the destination or whether it belongs to the marketplace. A card inside a package may say “scan to register your gift,” “claim a refund,” “review the product,” or “pay return postage.” Treat an unexpected instruction as a new request that needs verification, not as an official continuation of the delivery.
If you want to inspect the item, do so without scanning or calling the insert. Search the product name in your marketplace account or use the seller-contact process on the platform. Avoid searching for a support number and selecting a sponsored result; fake support listings can impersonate the marketplace too.
When to treat it as a possible account compromise
Escalate if the marketplace shows an order you did not place, your password or shipping address changed, a payment method was added, or your bank statement shows a charge you cannot explain. An unexpected parcel alone does not prove that your identity was stolen, but FTC advises changing passwords on your online shopping accounts as a precaution, then checking recent orders, saved details, and payment activity. A real, unauthorized order or account change is a stronger sign of compromise and deserves prompt escalation.
- Change the marketplace password from its official app or website, preferably from a trusted device.
- Change the same password anywhere else you reused it.
- Review account sessions, saved addresses, payment methods, and recent changes; sign out of unfamiliar sessions if the platform offers that control.
- Contact your card issuer using the number on the card or its official app if you find an unknown transaction.
- Save order records, package labels, messages, and support case numbers.
If a caller claims the parcel is dangerous, requires a fee, or must be sent back immediately, pause. Do not disclose a one-time code or full card details to “confirm” ownership. Use the marketplace’s official help flow to ask what it wants you to do. In the U.S., report suspected fraud to the FTC at ReportFraud.ftc.gov; for identity-theft recovery steps, use IdentityTheft.gov.
Should you keep, return, or throw away the item?
There is no universal answer for every seller, jurisdiction, or product. Do not assume you owe a payment just because a package has your name, and do not assume it is safe to use a product you cannot identify. Check the marketplace’s official process and local consumer-protection guidance. For food, cosmetics, supplements, electronics, or anything that could affect health or safety, use extra caution and do not consume or connect an unknown item while you are trying to identify it.
Keep a record before disposing of packaging. If a marketplace asks for information, provide it inside the official account rather than replying to a number or email printed on an unverified insert. Avoid paying return postage to a stranger unless the official platform confirms the return is required and gives you the verified process.
Why a fake review matters even if you lose no money
Brushing can distort the information shoppers rely on. A review attached to a real delivery can make a product seem tested by an independent customer when the recipient never selected it. That does not mean the recipient personally endorsed it. If you find a review in your name or tied to your account, report it through the platform’s official review or seller-investigation channel and keep a screenshot or case number.
Platforms may need time to investigate. Avoid public accusations naming a specific seller until the evidence is clear; a wrong attribution can harm an innocent business. Report the facts you can verify: the package was unsolicited, whether an order appears in your account, and whether a review was posted without your participation.
What not to do
- Do not scan an unexpected QR code just to “see what it is.”
- Do not call a number from an insert or follow a package link to resolve a surprise order.
- Do not share login codes, full payment details, or identity documents with someone who contacts you unexpectedly.
- Do not conclude that your identity is stolen from the parcel alone; check account and payment evidence.
- Do not accept private “recovery” offers from people who contact you after you post about the incident.
The practical rule
Verify the account, not the packaging. An unexpected parcel can be a brushing attempt, a gift, or a mistake; an insert cannot tell you which. Go directly to the marketplace, look for an order or review, check your statements, and report what you can substantiate. If there is no suspicious order or charge, you may have a nuisance package rather than an account takeover. If you do find account changes, secure the account and contact the relevant provider using a channel you chose yourself.
Related prevention guides: how to respond to a suspicious QR payment sticker, parcel redelivery requests that ask for card data, and fake purchase callbacks that route you to a scammer.