Got a Package You Didn't Order? What a Brushing Scam Means and What to Do

A package with your name on it showed up, maybe from Amazon or a seller you’ve never heard of, but you didn’t order it. The FTC says it could be a brushing scam, and a sign that someone has, or wants to steal, your personal information (FTC, August 2026). Here’s what that means, whether you can keep it, what not to do, and how to report it.

Why did I get a package I didn’t order with my name on it?

The FTC says it’s probably a scam, sometimes called “brushing” (FTC, January 2025). A seller ships you something so it has “validation” of delivery, then uses your name to post fake reviews and “brush up” its sales. Recent reports to the FTC say the box usually holds something cheap and random, like baby wipes, toothpaste or seeds (FTC, August 2026). Others have held fake “luxury” items like rings, beauty products and Bluetooth speakers (FTC, January 2025).

The sender is usually an international, third-party seller that found your address online, and the box may have no return address or a retailer’s, the Postal Inspection Service says (USPIS). Amazon says brushers send packages to “publicly available names and addresses,” and that third-party sellers are prohibited from sending customers unsolicited packages (Amazon).

Rule out the simple answers first. Amazon suggests making sure it isn’t a gift and checking whether friends or family ordered it (Amazon).

Two other possibilities:

• A QR code trap. The FBI warns that some unsolicited packages carry a QR code that leads to requests for personal and financial information, or to malicious software. The criminals often leave off any sender information so you’ll scan the code (FBI).
• Someone using your address. Some criminals use a person’s address and account information to have merchandise delivered, then steal it before the resident can get to it, the Postal Inspection Service says (USPIS). See someone is using my address.

Can I keep a package I didn’t order?

Yes. By law, companies can’t send you things you didn’t order and then demand payment, the FTC says. You never have to pay for them, you don’t need to return them, and you can keep them as a free gift (FTC). For items sent by mail, federal law also bars the sender from mailing you a bill or payment demands for them (39 U.S.C. § 3009).

The Postal Inspection Service lists your options (USPIS):

Option	When it fits
Keep it	You opened it and like it. You’re under no obligation to pay for it.
Mark it “Return to Sender”	It came by U.S. mail, unopened, with a return address. USPS returns it at no charge.
Throw it away	You opened it and don’t want it, as long as that’s safe.
Report it first	Seeds, food, plants, or an unknown liquid or substance. Tell the proper authorities and follow their instructions.

Even if you keep it, be careful using it. As the FTC puts it, you don’t know who sent it (FTC, August 2026).

Worried about what’s inside? The Postal Inspection Service says to isolate the package, keep your distance, wash your hands, and call 1-877-876-2455 and say “Emergency” (USPIS, USPIS). If someone needs medical attention, contact local authorities (USPIS).

Addressed to someone else? Amazon asks you to contact its Customer Service (Amazon). For U.S. mail addressed to someone who doesn’t live there, USPS says to write “Not at this address” on it and give it back to your carrier, and warns that destroying mail meant for someone else may be against the law (USPS).

What not to do

Don’t scan the QR code

Some packages include a note with a QR code to scan “to find out who sent the package, or to process a return.” Scanning could take you to a phishing site built to steal your credit card numbers, usernames or passwords (FTC, August 2026). It could also download malware onto your phone (FTC, January 2025). The FBI’s advice is simple: don’t scan QR codes from unknown origins (FBI).

Don’t pay for it

Don’t let anyone talk you into paying for the item (USPIS). The FTC says you never have to pay for things you didn’t order, and you don’t need to send them back (FTC).

A text demanding a delivery fee is a separate scam. In 2024, fake package-delivery texts were the most reported text scam, and many people reported paying a small “redelivery fee” that was really a trick to get their card or Social Security number (FTC, April 2025). USPS won’t text you unless you first asked for tracking with a tracking number, and those texts won’t contain a link (USPIS). More: USPS text scams and FedEx or UPS scam texts.

Don’t contact the sender

If you look up the sender and reach out, whoever answers will likely try to get more sensitive information from you to steal your money, the FTC warns (FTC, January 2025). Engaging with the sender may also confirm your address and lead to more unwanted packages, USPS says (USPS).

Does a brushing scam mean someone has my information?

Probably some of it. The FTC says a package you didn’t order means someone “likely has your personal information” (FTC, January 2025). USPS says it may mean criminals have your name, address and phone number (USPS). It could also mean scammers created an account in your name, or took over yours, on shopping sites to post reviews (FTC, 2020).

What to do:

1. Change your passwords. Start with your online shopping accounts (FTC, August 2026), then your email and any account with financial information (USPS).
2. Check your shopping accounts for activity that isn’t yours, and report anything you find to the site right away (FTC, 2020).
3. Check your credit reports. They’re free every week at AnnualCreditReport.com. Look for signs of identity theft (FTC, August 2026), like accounts in your name you don’t recognize (FTC, January 2025). Found one? See someone opened a credit card in my name.
4. Review your card and bank statements for transactions you didn’t make (FTC, January 2025).
5. Consider a credit freeze or a fraud alert (FTC, January 2025). Step by step: how to freeze your credit.

More, including how to opt out of people-search sites: a scammer has my personal information.

Package from China, or seeds you didn’t order?

Brushing boxes often come from international sellers, as noted above, and the same steps apply. Seeds need extra care. The FTC wrote about “mysterious seeds from China” in 2020, and said not to plant them or throw them away (FTC, 2020). Today’s steps come from the U.S. Department of Agriculture’s plant health agency, APHIS (APHIS):

• Don’t plant the seeds.
• Keep the seeds and packaging intact. Seal the seeds in a bag and put them in the freezer.
• Report them to your State Plant Health Director. Include the date you got them, the carrier and tracking number, and photos of the seeds, the shipping label and the packaging.

APHIS says no serious threats have been found in the seeds people have sent in. It also estimates that about a third of seed shipments were actually ordered, from websites that look U.S.-based but are run overseas (APHIS).

If you scanned the code, typed information or paid

• A username and password: change the password right away, make it strong, and turn on two-factor authentication (FTC, January 2025).
• A card number, or you paid a fee: report it to your card issuer immediately, using the number on the back of the card, and ask for a refund (FTC). More: I gave a scammer my credit card number.
• Your Social Security number: if someone used it, report it at IdentityTheft.gov. If not, or you aren’t sure, follow the steps at IdentityTheft.gov/databreach (FTC). More: I gave a scammer my Social Security number.
• Malware worries: a QR code could download malware and give hackers access to your phone (FTC, January 2025). The FTC’s steps if someone got into your device: update your security software, run a scan, delete anything it flags, and change your passwords (FTC). More: I scanned a fake QR code and I clicked a phishing link.

The scam recovery checklist can turn your situation into a step-by-step list.

Can I get my money back?

Maybe. It depends on how you paid. The FTC says it’s always worth asking the company you paid through whether there’s a way to get your money back, and federal law protects you from unauthorized use of your credit or debit card (FTC). A fee you approved yourself is less certain: that’s up to your card issuer.

How to report a brushing scam

1. Amazon. Once you’ve confirmed no one you know ordered it, report it with the Report Unwanted Package form linked on Amazon’s help page. You can also contact Amazon Customer Service with the number of unwanted packages and a tracking number from at least one shipping label (Amazon).
2. Another store or marketplace. Go to the company’s website and file a fraud report. Ask it to remove any fake reviews in your name (USPIS). Messaging the platform lets it investigate removing the seller, the FTC says (FTC, August 2026).
3. The FTC. Report the brushing scam at ReportFraud.ftc.gov (FTC, August 2026). The FTC uses reports to build cases and spot trends (FTC).
4. The Postal Inspection Service, if it came by U.S. mail. File a report (USPS) using the Mail Fraud form on its report page (USPIS), or call 1-877-876-2455 (USPIS).
5. The FBI, if there was a QR code. File at IC3.gov. Include who contacted you, any websites, emails or phone numbers, and any apps you downloaded or gave permissions to. If you’re 60 or older and need help filing, call the DOJ Elder Justice Hotline at 1-833-FRAUD-11 (833-372-8311) (FBI).

What happens next: Amazon says it investigates brushing reports and may suspend or remove selling privileges, withhold payments, and work with law enforcement (Amazon). The report-a-scam tool lists more official channels.

Watch for the follow-up scam

• “Return” instructions. A note that says to scan a code to process a return could take you to a phishing site (FTC, August 2026). You don’t need to return the item at all (FTC).
• “Suspicious charge” calls or texts. A call or text about a suspicious charge on your Amazon account may be a scammer, not Amazon. Log in through Amazon’s website or app instead, and don’t call back (FTC, March 2024). More: Amazon scam calls and texts.
• Recovery offers. If you lost money, someone may offer to get it back for a fee. Government agencies and legitimate organizations never ask for money to help you get a refund (FTC).

What varies

• How it arrived, and from which store. The free USPS return works for unopened mail with a return address (USPIS). For an Amazon package, Amazon says to contact its Customer Service about return options (Amazon). Other stores have their own report and return processes.
• What’s inside. Seeds, food, plants or an unknown substance call for a report before anything else.
• Whether you ordered something. Ordered something and got seeds or junk instead? That’s a different problem. The FTC says to dispute the charge right away with the payment service you used and your credit or debit card company (FTC, 2020).