untrappable

Brushing scam: why did a package I didn't order arrive?

Editorially reviewed · Last updated July 15, 2026

Yes — this is a scam. The package is real, but you didn't win anything — it's a “brushing” scam using your name to post fake reviews.

Text Message · Today 11:20 AM
from Parcel Rewards
Your free gift has shipped! Scan the QR code in your package or tap here to confirm delivery and claim your reward: parcel-rewards.info/claim
The Text message, as received

Other versions you might get: Unordered rings, seeds, beauty samples, phone chargers, or Bluetooth speakers — sometimes with a note or QR code, sometimes nothing at all. If you're billed for it or chased for payment, that's a different scam: by law you never have to pay for something you didn't order.

What to do right now

  1. Keep the package — you don't owe anything. By law you can keep unordered merchandise as a free gift; you never have to pay for it or send it back.
  2. Don't scan any QR code or tap any link that came with it. The FTC warns those lead to phishing sites that harvest your logins or install malware.
  3. Check your online-shopping accounts (Amazon and others) for orders, reviews, or addresses you don't recognize — change the password and turn on two-factor if anything looks off.
  4. Report it. Flag fake reviews posted in your name to the retailer, and file the scam at reportfraud.ftc.gov.

How to make sure it never bites you

A brushing package means your name and address are on a sold list somewhere. You can't unsend the package, but you can lock down the accounts tied to you and cut what's exposed — see how to lock down your accounts.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

I got a package I didn't order — is it dangerous to keep?
The item itself is usually harmless, and you're legally entitled to keep it — companies can't send you unordered merchandise and then demand payment. What's risky is any QR code, link, or note asking you to “claim,” “confirm,” or “review.” Don't scan or tap those; they lead to phishing sites. Keep or discard the product itself.
Why did I get a brushing package?
A third-party seller (often overseas) is using your name and address to place fake orders and post a “verified purchase” review that boosts their product. They got your details from a data breach or a broker list. It doesn't mean your bank or card was hacked, but it does mean your name and address are circulating.
Should I scan the QR code to find out who sent it?
No. The FTC warns that a QR code on an unexpected package is a new twist on brushing — scanning it can take you to a site that steals your information or installs malware. There's no safe reason to scan it. If you want to know more, log in to your shopping accounts directly and check your order history.
What should I do if I was actually charged for it?
Then it isn't a classic brushing scam — and you still don't have to pay for merchandise you never ordered. Dispute the charge with your card issuer, check the account it came from for fraud, and report it at reportfraud.ftc.gov.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.