You got a package you didn't order. Here's what's actually going on.
Updated August 6, 2026
A box shows up with your name and address on it. Inside is something cheap and random: a phone ring, seed packets, a plastic gadget, sometimes nothing but a card. You didn't order it, nobody you know sent it, and there's often no return address. This is called a brushing scam, and it's worth five minutes to understand, because the package itself is the least interesting part.
What brushing is
Online marketplaces rank sellers partly by verified sales and verified reviews. A "verified" review has to come from an account that genuinely bought and received the product. So dishonest sellers manufacture that trail: they buy their own product using a fake account, ship it to a real stranger's address (yours), and once the delivery is confirmed, the system lets them post a glowing five-star review in that buyer's name. Do this a few thousand times and a garbage product climbs the rankings.
The name comes from a Chinese e-commerce slang term for padding sales figures. The practice is old; what's new is the volume, and the extra payload that now rides along with it.
The question that should actually bother you
Not "who sent me a free ring", but "how did a stranger on another continent get my full name and home address". The unglamorous answer: your name and address are cheap. Data brokers sell them, old shopping databases leak them, and once one list circulates, it gets resold. A brushing package is often your first visible signal that your details are on one of those lists.
You can't un-leak an address, but you can make yourself a smaller target. The same broker listings feed spam calls, junk mail, and the more targeted scams that come later. Removing yourself from the big data broker sites is tedious to do by hand (there are hundreds), which is why paid removal services exist. We're not going to tell you that you need one; plenty of people just shrug at brushing packages and move on. But if the exposure bothers you, address removal is the one concrete fix that attacks the cause rather than the symptom.
The QR code card is the real trap
Increasingly, the package includes a printed card: scan this code to find out who sent your gift, to register your gift card, or to claim a reward. The FBI's July 2025 alert covers exactly this pattern. The code leads to a page built to harvest whatever it can get: a login form dressed up as Amazon, a "verify your card" form asking for bank details, or a prompt to install an app.
Don't scan it from curiosity. If you want to know where it leads, check it with a photo instead, which shows you the destination without your phone ever visiting it. And if curiosity already won, here's what to do now, and the honest news is it's probably fine if you didn't type anything in.
Is the product itself dangerous?
Almost never. It's usually the cheapest item the seller could ship with tracking. You're legally allowed to keep unsolicited merchandise in the US (the FTC is clear on that). Seeds are the one exception worth caring about: don't plant mystery seeds, agriculture departments ask that you report those.
What to actually do
- Keep or toss the item. You don't owe anyone anything.
- Don't scan the code or visit any address printed on the insert.
- If it's branded as Amazon, report it in your Amazon account (Help, then "report something suspicious"), because the review posted in "your" name pollutes results for everyone.
- Check your accounts for logins you don't recognize. Brushing sometimes accompanies a compromised account rather than a bought address list, and that's worth ruling out.
- Report the package at ic3.gov and, if it came through the mail, to the US Postal Inspection Service. Reports are what turn one weird box into a pattern investigators can act on.
When it isn't brushing
Occasionally an unexpected package really is a mislabeled gift or a shipping error, and there's a rarer, nastier variant where the "package" is a pretext for a follow-up call from a fake courier or bank. If anyone contacts you about the package afterward, asking you to confirm details, pay a fee, or move money, that call is the scam, whatever the box was. Hang up and use the number on the back of your actual card. The same instinct applies to voice calls that sound like family, which have become the sharpest version of this whole category.