An unexpected package arriving with no order behind it might seem like a harmless mix-up or even a small windfall, but the Federal Trade Commission has cautioned that it can be the visible edge of a scheme known as “brushing.” In an August 2026 consumer alert, the agency warned that such deliveries are often sent by sellers who use a recipient’s name and address to post fake reviews, and that the surprise parcel can also signal that personal information has fallen into the wrong hands.
The packages themselves tend to be unremarkable, which is part of what makes the tactic easy to overlook. Recipients report receiving cheap, random items they never bought, sometimes repeatedly. The FTC’s warning reframes those deliveries not as a quirk of e-commerce but as a byproduct of a manipulation aimed at gaming online marketplaces, one that can carry a quieter warning about exposed data.
How a brushing operation works
The mechanics center on fake reviews. A seller ships an inexpensive product to a real name and address so that a delivery is recorded, then uses that name to post a review of the item, making it appear to come from a verified buyer. Marketplaces tend to weight reviews from confirmed purchases more heavily, so a fabricated but “verified” review can lift a product’s rating and visibility. The recipient never ordered anything and never pays, but their identity has been borrowed to lend the review legitimacy, a pattern the FTC described in its consumer alert on the practice.
The items sent are typically low in value precisely because the goal is the delivery record, not the product. Common examples include things like seeds, small household goods, or inexpensive personal-care items. Their randomness is a clue: a package that matches nothing a person shopped for, contains something trivial, and arrives without an obvious sender is the signature of a brushing shipment rather than a genuine order or gift.
Why an unordered box is a data warning
The more serious implication is what the delivery says about a recipient’s personal information. To send the package, the seller already had a working name and mailing address, and the FTC has cautioned that receiving one can be a sign that those details, and possibly more, have been compromised. The parcel is not itself the breach, but it can be the symptom that surfaces one.
That is why the agency’s guidance treats a brushing delivery as a prompt to check for broader exposure rather than as a standalone curiosity. If a name and address are circulating among sellers willing to misuse them, other account information may be circulating too. Reviewing financial statements and shoring up account security in response addresses the risk that the visible package hints at something less visible.
The QR code twist
The FTC also flagged a newer variation that turns the package into a phishing lure. Some brushing shipments now arrive with a QR code and a message urging the recipient to scan it, with prompts such as an invitation to “scan to return” the item or to find out who sent it. Curiosity about a mystery package is exactly the impulse the tactic exploits.
Scanning such a code can route a person to a fraudulent website built to harvest sensitive information, including login credentials and credit card numbers. The agency’s guidance is to avoid scanning QR codes that come with unexpected packages, because the code offers no legitimate benefit and can carry real risk. What looks like a convenient way to solve the puzzle of an unordered box can instead be the mechanism that hands over the very data the recipient should be protecting.
What the law says about keeping it
One point of reassurance is settled: recipients are under no obligation to pay for or return merchandise they did not order. Longstanding consumer protections treat unordered goods as a gift to the recipient, so there is no debt attached and no requirement to send anything back. That legal footing removes the leverage a scammer might otherwise try to manufacture, and it means a person confronted with a strange package does not owe anyone money.
The practical response, according to the FTC, is less about the item and more about the exposure it may signal. The agency recommends changing passwords on online shopping accounts, keeping an eye on credit card and bank statements for unfamiliar charges, and confirming that no charge has appeared for the mystery item. Those steps address the underlying concern, which is not the cheap product but the possibility that personal information is being used without permission.
Reading the signs and responding
Taken together, the guidance amounts to a simple posture toward the unexpected box: do not scan any attached QR code, do not assume the delivery is benign, and treat it as a reason to review account security. The package costs the recipient nothing directly, but ignoring what it may indicate can be costly if compromised data is later put to more damaging use.
The broader lesson is that fraud increasingly hides inside ordinary-looking events. A brushing delivery exploits the assumption that a free item is a lucky accident, when it is more often a marker that a name and address are being traded and misused. The FTC’s warning is a reminder that the appropriate reaction to an unordered package is not delight or dismissal but a quick, deliberate check of one’s own accounts and information.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
