untrappable

Brushing scam: why did a package I didn't order arrive?

Editorially reviewed · Last updated August 21, 2026

Yes — this is a scam. The package is real, but you didn't win anything — it's a “brushing” scam using your name to post fake reviews.

Text Message · Today 11:20 AM
from Parcel Rewards
Your free gift has shipped! Scan the QR code in your package or tap here to confirm delivery and claim your reward: parcel-rewards.info/claim
The Text message, as received

Other versions you might get: Unordered rings, seeds, beauty samples, phone chargers, or Bluetooth speakers — sometimes with a note or QR code, sometimes nothing at all. If you're billed for it or chased for payment, that's a different scam: by law you never have to pay for something you didn't order.

What to do right now

  1. Keep the package — you don't have to pay or send it back. The FTC says the law does not require you to return unordered merchandise. Be cautious about using the product; you don't know who sent it.
  2. Don't scan any QR code or tap any link that came with it. The FTC says a note may tell you to find the sender or process a return; that can open a phishing site for card numbers, usernames, or passwords.
  3. Change passwords on your online shopping accounts. If the package looks like it came from Amazon or another marketplace, message that platform from an account you already have so they can look at the seller.
  4. Check your credit reports weekly for free at AnnualCreditReport.com and watch for identity theft.
  5. Report it at reportfraud.ftc.gov.

How to make sure it never bites you

A brushing package means your name and address are on a sold list somewhere. You can't unsend the package. Change shopping-account passwords, check your credit reports, and lock down the accounts tied to you — see how to lock down your accounts.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

I got a package I didn't order — is it dangerous to keep?
The FTC says you can keep unordered merchandise and you don't have to pay for it or send it back. What's risky is any QR code, link, or note asking you to claim a gift, find the sender, or process a return — don't scan or tap those. Be cautious about using the product itself; you don't know who sent it.
Why did I get a brushing package?
A third-party seller (often overseas) is using your name and address to place fake orders and post a “verified purchase” review that boosts their product. They got your details from a data breach or a broker list. It doesn't mean your bank or card was hacked, but it does mean your name and address are circulating.
Should I scan the QR code to find out who sent it?
No. The FTC says a QR code or note may tell you to find the sender or process a return. Scanning can open a phishing site that steals card numbers, usernames, or passwords. There's no safe reason to scan it. Log in to your shopping accounts directly if you want to check your order history.
Should I check my credit after a brushing package?
Yes. The FTC says an unexpected package can be a sign that someone has, or is looking to steal, your personal information. Check your credit reports weekly for free at AnnualCreditReport.com and watch for identity theft.
What should I do if I was actually charged for it?
Then it isn't a classic brushing scam — and you still don't have to pay for merchandise you never ordered. Dispute the charge with your card issuer, check the account it came from for fraud, and report it at reportfraud.ftc.gov.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.