Brushing Scam: Why You Got a Package You Didn't Order

You open the door and find a parcel with your name and address on it — but you never ordered anything. Inside is something cheap and random: seed packets, a phone ring, costume jewellery, a beauty gadget. No invoice, no gift note, and a sender you don't recognise. This is almost always a brushing scam. The item itself is usually harmless, but it tells you something worth acting on: your name and address are circulating in a dataset you never agreed to be in.

What a brushing scam actually is

Brushing is a fake-review trick used by dishonest sellers on big marketplaces. The seller ships a cheap item to a real address — yours — so the marketplace records a genuine, completed delivery. That lets the seller (or an account they control) post a verified purchase review under a name like yours, inflating the product's rating and sales rank.

You are not the customer in this scheme; you are the delivery proof. The seller pays for the item and the postage themselves, which is why the products are almost always the cheapest things they can ship.

How they got your address

Most brushing targets were exposed in an ordinary data leak or a scraped public record — a breached shop database, a marketplace seller who resold customer lists, or public directory data. In most cases it does not mean someone has access to your accounts or payment cards.

Still, treat it as a prompt to check. If your address leaked from a specific store's database, your email and phone number may have leaked with it, and those get used for phishing later.

Is it dangerous, and can you keep the item?

In the US, unordered merchandise sent to you is legally yours to keep — the FTC is explicit that you don't have to pay for or return it. Similar rules apply in the UK and EU. So keep it, donate it, or bin it.

Two exceptions deserve care:

• Seeds or plant material: don't plant them. Report unsolicited seeds to your national or state agriculture department (in the US, your state's Department of Agriculture or USDA), and dispose of them as they instruct.
• Food, cosmetics or supplements: throw them away. You have no idea what's in them or how they were stored.

The QR code trap

Newer brushing packages often contain no product information at all — just a card saying something like "Scan to see who sent your gift" or "Scan to claim your reward." Don't scan it. That QR code is the actual payload: it can lead to a phishing page that asks for login details or card numbers, or push a malicious app install.

If you already scanned one, close the page without entering anything, and paste the link or any follow-up message into the HasTrust scam checker to see what it's pointing at. If you typed a password anywhere, change that password now.

What to do, step by step

1. Don't pay anything and don't scan anything. No legitimate sender charges you for a package you didn't order.
2. Check your marketplace accounts. Open your order history on Amazon and any other marketplaces you use. If the package doesn't appear in your orders, no one used your account — that's the good outcome. If it does appear as an order you didn't place, treat it as account takeover: change your password immediately and contact the platform.
3. Check your bank and card statements for the last few weeks. Brushing itself doesn't charge you, but confirm nothing else is going on.
4. Report the package. On Amazon, search Help for "Report unwanted package" — there's a dedicated form; have the shipping label handy (tracking number, sender details). Other marketplaces accept reports through their standard customer service chat. Reports matter: platforms suspend sellers caught brushing.
5. Report the scam more widely if you wish. In the US: ReportFraud.ftc.gov, and USPS if it arrived by mail. In the UK: Action Fraud. In Canada: the Canadian Anti-Fraud Centre.
6. Harden your accounts. Turn on two-factor authentication for your email and marketplace logins, and change any password you've reused across shops. Your email account is the one that matters most — it can reset everything else.

When to worry more

One mystery parcel is an annoyance. Escalate your response if you also notice any of these:

• Order confirmations or delivery emails for things you didn't buy — could be phishing bait or a compromised account. Check the sender address carefully before clicking anything.
• Password-reset emails you didn't request.
• Packages arriving repeatedly, or high-value items followed by a "courier" asking to collect a mis-delivered parcel — that's a different scam (interception fraud), and you should refuse and report it.

Check before you buy from unfamiliar shops

Brushing exists because fake reviews work — they make bad sellers look trustworthy. So treat glowing ratings on unfamiliar stores and marketplace listings with healthy suspicion, especially on ultra-cheap goods from AliExpress-style marketplaces or unknown standalone webshops.

Before ordering from a store you've never used, look it up on HasTrust to see its trust score, real customer experiences and registration details. A minute of checking is cheaper than a dispute — and it keeps your address out of the next leaked customer list.