An Amazon package you didn't order just arrived. Here's the sequence.

Updated August 6, 2026

Open the box, look for a small printed card with a QR code on it, and don't scan it. That's the whole emergency. Everything else can wait for coffee. In almost every case a package you never ordered is a brushing scam: a marketplace seller shipped something cheap to your real address so a fake buyer account can post a "verified purchase" review. You're allowed to keep it and you owe nobody a cent.

The item is usually forgettable. A phone ring holder, a packet of seeds, a silicone spatula, a bracelet in a padded envelope. What matters isn't the object. It's how your name and address ended up on a shipping label, and there are only two real answers to that.

Rule out the boring explanations first

Before you assume fraud, spend two minutes on the dull possibilities. A relative ordered a gift and didn't include a gift receipt. Someone in the house ordered it and forgot. An old address of yours is still sitting in a friend's Amazon address book. Occasionally a warehouse mislabels a package and it lands on the wrong porch entirely.

Then check your own order history on a desktop browser, not the app. Go to Returns and Orders, open the date filter above the list, and look at the bottom for Archived Orders. Archived orders don't show in the normal view and they're invisible in the mobile app, which is exactly where an unwanted order would hide if someone had access to your account.

Report it through Amazon's actual form

Amazon has a dedicated page for this called Report Unsolicited Packages or Brushing Scams, and it points to the Report Unwanted Package form at account-status.amazon.com/report-unwanted-packages. You'll need the tracking number or order ID from the shipping label and the delivery address. That's it. There's no phone call required.

Do not call any customer service number printed on the packing slip or the insert card. Those numbers frequently belong to the people who sent the box. If you want to talk to Amazon, start from inside your own account and use the contact route Amazon shows you there.

Set your expectations low on the reply. Amazon investigates seller accounts internally and doesn't generally write back to tell you what happened. Reporting still matters, because the report ties a real address to a seller ID, and that's the evidence Amazon needs to pull a listing.

Was your account compromised, or did someone just buy your address?

These are two very different situations and you can usually tell them apart in five minutes. The address-list version is far more common, and it's the less alarming one.

• Check for a charge. Look at Your Orders, then Your Payments, then your actual card statement for the delivery week. No charge anywhere means the seller paid for the item themselves, which is the ordinary brushing pattern.
• Check Login and security. Confirm the email address and phone number on file are still yours. A changed recovery email is the loudest possible signal that someone else is in there.
• Look for payment methods or addresses you didn't add. A gift card balance you don't recognize counts too.
• Turn on two-step verification if it isn't already on, and change the password to something you use nowhere else.

If all of that is clean, nobody hacked you. Your name and street address were on a list somebody bought, and a seller in another country used that list to fake sales volume. Annoying, not an emergency.

About the review posted in your name

This is the part that unsettles people most, and it's usually less personal than it feels. The review typically comes from an account the seller created that happens to carry a name resembling yours, not from your account. Delivery to a genuine address is what earns the "verified purchase" badge, and the badge is the whole point of the exercise.

Still, go look. Open your Amazon profile and read the reviews attributed to you. If there's anything you didn't write, report it to Amazon and delete it. Fake reviews aren't just a policy problem now: the FTC's Consumer Reviews and Testimonials Rule took effect on October 21, 2024, and it allows civil penalties of up to $51,744 per violation against knowing violators, which is a large part of why platforms have gotten faster at removing them.

You can legally keep it

Federal law treats unordered merchandise as a gift. That's 39 U.S.C. 3009, backed by the FTC, and the US Postal Inspection Service puts it plainly: you "may keep unsolicited merchandise and are under no obligation to pay for it." You don't have to return it, and any bill or demand for payment that follows is itself illegal.

One honest caveat. The statute is written about merchandise sent through the mail, and plenty of these boxes arrive by other carriers. The FTC has treated the practice as an unfair trade practice regardless of carrier, so in practice you're fine, but I'm not going to pretend the wording is perfectly clean.

If the box is unopened and has a return address, you can write RETURN TO SENDER on it and hand it back to USPS. If it's opened, bin it or keep it. What I wouldn't do is eat, swallow, or apply anything edible or cosmetic that arrived this way, and I wouldn't plug an unidentified charger or battery into anything.

The card in the box is the real threat

Brushing on its own is a nuisance. The version that costs people money is newer: a small printed card saying something like "scan to find out who sent this" or "register your free gift." The FBI issued a public service announcement about exactly this, alert I-073125-PSA on July 31, 2025, warning that these codes push people toward phishing pages or malware installs.

We wrote up the card that comes inside these packages separately, because the wording varies and the patterns are worth recognizing. If you're curious where a code actually leads, you can decode a photo of the QR code in your browser and read the destination as plain text without your phone ever opening it. And if you already scanned one, the recovery steps are here, in order, starting with the first hour.

What actually reduces your exposure

Changing your Amazon password doesn't remove your address from the list it came from. For that, you're looking at data brokers. California residents can now file one deletion request through the state's DROP platform, run by the California Privacy Protection Agency, and as of August 1, 2026 registered brokers must check that platform at least every 45 days and act on what they find. Other states vary a lot, and several have no broker deletion right at all.

Freezing your credit at Equifax, Experian, and TransUnion is free, takes about fifteen minutes total, and blocks the outcome people actually fear here. Weekly credit reports are free at annualcreditreport.com. If new accounts appear in your name, IdentityTheft.gov walks you through the recovery paperwork step by step.

When it's worth escalating

Escalate if packages keep arriving, if you scanned the code, or if anything financial follows. Consumer complaints go to reportfraud.ftc.gov, QR and cyber-enabled fraud goes to ic3.gov, and the Postal Inspection Service takes reports at 1-877-876-2455. Anyone 60 or older can call the Justice Department's Elder Justice Hotline at 1-833-372-8311 and get walked through it by a person instead of a form.

Seeing the same thing from other marketplaces? The routes differ, and unordered Temu and Shein packages need a different fix. For the general version of why any of this happens at all, the mechanics of brushing hold across every platform.

An unordered package proves one narrow fact: a shipping label carrying your details exists in somebody's system, and it probably did before the box turned up. It doesn't prove anyone got into your account. The printed card inside is where the money risk sits. The object in the box isn't.