A parcel of baby wipes, toothpaste or a packet of seeds that nobody ordered is, according to an August 20, 2026 consumer alert from the Federal Trade Commission, a possible sign that a stranger is using the recipient’s name to post fake reviews online. The scheme is called brushing, and the free package is not a gift but the paperwork for a lie.
The cost of the item to the sender is pennies. The value is a shipping record with a real name and address attached to it.
Why a scammer needs a delivery record with a real name on it
The FTC’s alert explains that brushing scammers use a person’s name to place fake reviews online about their own business, to “brush up” its sales. To post a review that the marketplace treats as coming from a buyer, the seller needs what the agency calls validation of delivery. A cheap parcel that actually arrives at a real door supplies it, and the review then appears under the recipient’s identity, praising a product that person never saw.
The typical contents are the reason the scheme is easy to miss. The alert lists baby wipes, toothpaste and seeds, items that are cheap, random and easy to shrug off. Because they are not obviously connected to a purchase, many recipients simply keep or discard them without wondering whose account made the order.
The Postal Inspection Service names the harm to outsiders as well. Its page says scammers write fake positive reviews using victims’ names, and shoppers who trust those reviews may buy worthless items as a result. The person whose name was borrowed is therefore both a target and an unwitting endorser, with a review history they did not write and cannot easily see unless they search for it.
The second trap: a QR code in the box
Some of these parcels carry a note with a QR code. The FTC warns that scanning such a code can lead to a phishing site designed to steal information like credit card numbers, usernames or passwords. The U.S. Postal Inspection Service, which investigates crimes involving the mail, describes the same variation on its brushing scam page as a quishing version, with cards that redirect recipients to fake sites that harvest personal information.
That makes the free package a delivery mechanism for two separate frauds: reviews forged in the recipient’s name, and a lure aimed at the recipient’s accounts. The FTC has issued a parallel warning about QR codes stuck over parking meter payment codes, and the logic is the same: a printed square hides its destination until it is scanned.
Advice from the FTC and the Postal Inspection Service
On the legal question that worries most recipients, the FTC is direct: the law says a person does not need to return or pay for things that were not ordered. The Postal Inspection Service’s guidance is compatible but adds a practical option, telling recipients not to pay for unsolicited merchandise, to mark unopened packages “Return to Sender” for free USPS return, and to discard opened items safely if they are unwanted. The FTC also cautions that the origin of a received product is unknown, which is a reason to hesitate before using it.
The two agencies differ in emphasis rather than substance. The FTC settles the ownership question: an unordered parcel creates no debt and no duty to send it back. The Postal Inspection Service answers the logistics question of what to do with a box that arrives sealed, where a free return through the Postal Service gets it out of the house without a trip to a carrier counter or any exchange with the sender.
The account-protection steps overlap. The FTC recommends resetting passwords on all shopping accounts, reporting the suspicious seller to the marketplace platform, and checking credit reports weekly at AnnualCreditReport.com for signs of identity theft. The Postal Inspection Service adds that recipients should tell retailers such as Amazon or eBay so that the fraudulent reviews are removed, and that changing passwords should happen immediately. Package theft is a further risk it flags, since a scammer with an address and account details may try to intercept merchandise before a resident does.
Anyone who has scanned a code from the box should follow the FTC’s guidance on what to do after a scam, and suspected fraud can be reported to the FTC at ReportFraud.ftc.gov. The Postal Inspection Service takes reports of suspected mail crimes at 1-877-876-2455.
What the alert leaves open is scale. It gives no count of brushing victims and no figure for fake reviews, and the only quantity it offers is the one on the shipping label: a parcel cheap enough that the sender would sooner mail it to a stranger than to a customer.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Hackers are hijacking outdated home routers, and the FBI named the models to check
- Older Teslas are wearing out in ways early owners never saw coming
- Early electric-car owners are hitting battery and screen failures no one warned them about
- A magnitude 5.3 quake struck off the Oregon coast this week
