A federal warning is putting a name to a shopping-world nuisance that leaves people holding boxes they never bought. On August 20, 2026, the Federal Trade Commission told consumers that an unexpected parcel arriving on the doorstep may be part of a “brushing” scheme, in which a stranger uses a real person’s name and address to post fake reviews. The alert also cautions that the surprise delivery can be an early clue that personal information has already leaked.
How a brushing scheme uses a real name
The setup begins with a package that looks like it came from a familiar retailer such as Amazon, or from a company or individual the recipient has never heard of. According to the FTC consumer alert, recent reports describe cheap, random contents inside, such as baby wipes, toothpaste, or seeds. The point of the exercise is not generosity. A seller needs a verified delivery to a genuine address so it can post a review under that person’s identity and inflate its ratings, “brushing up” the appearance of legitimate sales.
The tactic works because online marketplaces weight reviews tied to confirmed purchases more heavily than anonymous ones. By shipping a low-value item to a real address the seller manufactures the paper trail that a “verified” review requires, then attaches glowing text the recipient never wrote. The recipient becomes an unwitting prop in a ratings-manipulation operation, and the products themselves are almost incidental.
The QR code inside the box
Some parcels arrive with a note carrying a QR code, framed as a convenient way to learn who sent the gift or to start a return. Scanning it can route a phone to a counterfeit site built to harvest credentials. The FTC’s guidance on recognizing and avoiding phishing scams describes the same playbook, in which an urgent or curiosity-driven prompt pushes a target toward a page designed to capture card numbers, usernames, and passwords. Treating an unsolicited code as a link from an unknown sender, rather than a helpful shortcut, is the safer default.
Why an unordered package can point to stolen data
Beyond the fake-review angle, an out-of-nowhere delivery can indicate that a name, address, or account is already circulating. That makes routine account hygiene the practical response. The commission recommends changing passwords across online shopping accounts in case any were compromised, and, when a marketplace shipped the item, messaging the platform so it can investigate removing the seller. Watching for the warning signs described in the FTC’s overview of identity theft helps a recipient distinguish a one-off ratings ploy from a broader misuse of personal information.
Credit monitoring is part of the same defensive posture. Regularly reviewing a credit report for unfamiliar accounts or inquiries can surface fraud that a single stray package would never reveal on its own. The agency frames the delivery less as an isolated event than as a prompt to check whether other data has moved without permission.
What the law says about merchandise no one ordered
Recipients are not obligated to pay for or send back goods that showed up uninvited. The FTC’s explainer on unordered merchandise spells out that items arriving without a request can legally be kept, and that no payment is owed. The agency still urges caution before using anything from an unknown source, since the contents and the sender’s intentions are both unverified. The legal freedom to keep the box does not extend to any assurance about what is inside it.
Reporting a suspected brushing scam
The commission asks anyone who spots the pattern to file a report through ReportFraud.ftc.gov, which feeds a database used by investigators tracking deceptive sellers and identity-theft trends. Because brushing depends on volume, individual reports help regulators and platforms map the networks behind coordinated fake reviews. The mechanics have not changed dramatically over the years, but the August alert underscores that the schemes remain active and that the boxes keep arriving.
For consumers, the throughline is straightforward: a free-looking parcel with no clear origin is worth a second look rather than a shrug. The item may be worthless, but the delivery can signal that a name has been pressed into service for someone else’s sales pitch, or that personal details are already in the wrong hands. Recognizing the pattern is what turns a confusing package into a manageable one.
Part of a broader push against fake reviews
The brushing warning arrives as regulators sharpen their focus on deceptive online reviews more generally. Manipulated ratings distort the marketplace by steering shoppers toward products whose popularity has been manufactured rather than earned, and brushing is one of the cruder mechanisms behind that distortion. The commission has folded the tactic into its running series of consumer alerts, which flag emerging schemes as reports accumulate. The August notice fits a pattern in which the agency treats seemingly minor annoyances, an odd package here, a suspicious code there, as symptoms of larger fraud ecosystems.
That framing helps explain why an isolated free delivery is worth taking seriously. A single unordered box rarely causes direct financial loss, but it can be a visible edge of a much larger operation trading in stolen identities and counterfeit credibility. Understanding the incentive behind the package, cheap validation for a dishonest seller, is what allows a recipient to respond proportionately rather than either panicking or ignoring a genuine warning sign.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Card skimmers hidden on gas pumps and ATMs are draining accounts, and here’s the tell
- The FBI says hackers are hijacking outdated home routers, and it named the models to check
- Older Teslas are wearing out in ways early owners never saw coming
- A common childhood virus is now tied to multiple sclerosis years later
