MalwareZero

You got a package you didn't order. Here's what's actually going on.

Updated August 6, 2026

A box shows up with your name and address on it. Inside is something cheap and random: a phone ring, seed packets, a plastic gadget, sometimes nothing but a card. You didn't order it, nobody you know sent it, and there's often no return address. This is called a brushing scam, and it's worth five minutes to understand, because the package itself is the least interesting part.

1Your Address LeaksData brokers sell or leak name & address 2Fake Account PurchaseSeller buys own product to fake a sale 3Ships To Your AddressPackage sent to a real stranger: you 4Delivery Confirms SaleTriggers a verified 5-star review as you 5QR Code Bait CardInsert lures a scan to a phishing page
How a brushing scam reaches your door

What brushing is

Online marketplaces rank sellers partly by verified sales and verified reviews. A "verified" review has to come from an account that genuinely bought and received the product. So dishonest sellers manufacture that trail: they buy their own product using a fake account, ship it to a real stranger's address (yours), and once the delivery is confirmed, the system lets them post a glowing five-star review in that buyer's name. Do this a few thousand times and a garbage product climbs the rankings.

The name comes from a Chinese e-commerce slang term for padding sales figures. The practice is old; what's new is the volume, and the extra payload that now rides along with it.

The question that should actually bother you

Not "who sent me a free ring", but "how did a stranger on another continent get my full name and home address". The unglamorous answer: your name and address are cheap. Data brokers sell them, old shopping databases leak them, and once one list circulates, it gets resold. A brushing package is often your first visible signal that your details are on one of those lists.

You can't un-leak an address, but you can make yourself a smaller target. The same broker listings feed spam calls, junk mail, and the more targeted scams that come later. Removing yourself from the big data broker sites is tedious to do by hand (there are hundreds), which is why paid removal services exist. We're not going to tell you that you need one; plenty of people just shrug at brushing packages and move on. But if the exposure bothers you, address removal is the one concrete fix that attacks the cause rather than the symptom.

The QR code card is the real trap

Increasingly, the package includes a printed card: scan this code to find out who sent your gift, to register your gift card, or to claim a reward. The FBI's July 2025 alert covers exactly this pattern. The code leads to a page built to harvest whatever it can get: a login form dressed up as Amazon, a "verify your card" form asking for bank details, or a prompt to install an app.

Don't scan it from curiosity. If you want to know where it leads, check it with a photo instead, which shows you the destination without your phone ever visiting it. And if curiosity already won, here's what to do now, and the honest news is it's probably fine if you didn't type anything in.

Is the product itself dangerous?

Almost never. It's usually the cheapest item the seller could ship with tracking. You're legally allowed to keep unsolicited merchandise in the US (the FTC is clear on that). Seeds are the one exception worth caring about: don't plant mystery seeds, agriculture departments ask that you report those.

What to actually do

When it isn't brushing

Occasionally an unexpected package really is a mislabeled gift or a shipping error, and there's a rarer, nastier variant where the "package" is a pretext for a follow-up call from a fake courier or bank. If anyone contacts you about the package afterward, asking you to confirm details, pay a fee, or move money, that call is the scam, whatever the box was. Hang up and use the number on the back of your actual card. The same instinct applies to voice calls that sound like family, which have become the sharpest version of this whole category.