A small box addressed to a person who never ordered anything, holding a packet of seeds, a tube of toothpaste or a pack of baby wipes, is the calling card of what the Federal Trade Commission calls a brushing scam. The agency's Bureau of Consumer Protection staff described the pattern in a consumer alert dated August 20, 2026, and warned about a newer twist: a note inside the package with a QR code, which is where the real danger sits.
The item itself is cheap and harmless to keep. The trouble comes from what the sender wants in return, which is either a fake review carrying the recipient's name or a scan that hands personal details to a phishing site.
Why a stranger mails a free item
In the FTC's August 2026 alert, the scheme works by producing what the agency calls validation of delivery. A seller ships a low-cost product to a real address, and the delivery record lets the seller post reviews online under the recipient's name, inflating the seller's reputation with reviews that look genuine to shoppers. The packages arrive from unfamiliar sellers or from established companies, and the typical contents named by the FTC are baby wipes, toothpaste and seeds.
The recipient does not have to do anything for the scam to work. The review is written by the sender, using a name and address the sender already has, and the first sign is often only the box on the porch.
The QR code turns a nuisance into a trap
Some packages include a note with a QR code that claims to reveal who sent the parcel or to let the recipient process a return. The FTC says scanning such a code can send a phone to a phishing website built to harvest credit card numbers and login credentials. The curiosity is the lure: a person wondering why a box of toothpaste arrived is being handed an easy way to find out.
The agency had already warned about the tactic. Its January 23, 2025 alert, written by consumer education specialist Alvaro Puig, told recipients not to scan the code and identified such parcels as a variant of the brushing scam. It advised anyone who had already scanned one or typed in credentials to change passwords immediately, turn on two-factor authentication, check credit reports at AnnualCreditReport.com, watch bank and card statements, and consider a credit freeze or fraud alert. Identity theft can be reported at IdentityTheft.gov.
A separate FTC alert from December 6, 2023 explains the general danger. Malicious codes point to spoofed sites or install malware, and scammers have gone as far as covering parking meter QR codes with their own. The advice there is to inspect the address for misspellings or altered letters before going further.
The law on keeping unordered items, and what to do with seeds
The FTC's August alert states that the law does not require a recipient to return things that were never ordered, and its separate guidance on unordered merchandise says companies cannot send unordered merchandise and then demand payment. Under that page, a person never has to pay for such items or send them back, and may keep them as a free gift. The main exception the FTC notes is a disguised subscription, where a free trial that converts to automatic billing might itself be a scam.
That legal position does not make every item safe to use. The FTC alert cautions that handling unknown items carries risks of its own. Seeds carry a separate concern that the U.S. Department of Agriculture has addressed. Its Animal and Plant Health Inspection Service says that recipients should not plant unsolicited seeds, and should keep the seeds and packaging intact and report them, sealing the seeds in a bag and placing them in the freezer until contacted. Per the APHIS guidance, "Non-compliant seeds can carry harmful pests or diseases that threaten U.S. agriculture and natural resources."
The same page adds a measured note: APHIS says it "is not aware of any incidents of seeds that have resulted in new pests or disease outbreaks," though it stresses that prevention remains critical. Reports of brushing packages themselves go to the FTC at ReportFraud.ftc.gov, alongside the step of reporting the seller to the marketplace where the fake review appeared. The FTC also recommends changing passwords on shopping accounts and checking credit weekly.
The alert leaves one question open: whether a recipient can ever learn who actually sent the parcel. The FTC's guidance stops short of promising an answer, and it points instead to the steps that limit the damage, which are leaving the QR code unscanned, securing shopping accounts, watching credit reports, and reporting the package so investigators can connect one recipient's box to the next.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Doctors warn a silent liver disease now affects one in three American adults
- Hackers are hijacking outdated home routers, and the FBI named the models to check
- Older Teslas are wearing out in ways early owners never saw coming
- Early electric-car owners are hitting battery and screen failures no one warned them about
