It’s a scenario that's becoming more common: You arrive home to find a package on your porch. Your name and address are on the package, but you didn’t order it and no one in your household recognizes it.
Don’t assume that it’s simply a shipping mistake — you might be dealing with a brushing scam. Brushing scams, also known as package scams, are becoming so common that the Federal Trade Commission (FTC) posted a warning about the scams in August.
The packages received in a brushing scam often contain a cheap item, and sellers send them so they can create fake verified reviews. The cheap item isn’t necessarily the problem; the bigger concern is how the sender got your information.
From just $107.88 $24.99 for Kiplinger Personal Finance
Become a smarter, better informed investor. Subscribe from just $107.88 $24.99, plus get up to 4 Special Issues
Sign up for Kiplinger’s Free Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
What is a brushing scam?
In a brushing scam, a seller sends an inexpensive product to a real person’s address, so delivery is confirmed and the purchase appears legitimate. The seller covers the cost of the product, so you never receive a bill.
Once the delivery is confirmed, the seller may use your identity to create a fake "verified" review to help artificially boost the product’s reputation, leading to more real sales. According to the USPS, brushing is illegal in the U.S.
To pull off the scam, scammers need genuine names and addresses, which they may get through a data breach or illegal database. That information might include compromised or publicly available data.
If you receive a package in a brushing scam, it may mean that your name and address have been compromised in a data breach. However, that doesn’t automatically mean the scammer has your Social Security number, bank account information or full identity.
If you're concerned that other personal information has been exposed, identity protection services such as Coveron and LifeLock can monitor for signs of compromised information, including data found on the dark web. These services won't prevent a brushing scam, but they can alert you to other potential risks involving your personal information.
Don't scan a QR code inside the package
A new "quishing" variation adds another layer of risk to the scam. Some scammers are sending out packages including a card with a QR code; the card might instruct you to scan the code to return the item, or it might include a message like, “Scan to see who sent your gift.”
The QR code may direct victims to a phishing website designed to capture usernames, passwords, credit card information, birthdates, Social Security numbers, or other sensitive information. According to the FBI, QR codes in unsolicited packages might also lead to malicious software that could steal data from the victim’s phone.
If you receive an unsolicited package, don’t scan any QR codes that it might contain.
What to do if you receive a package you didn't order
If you receive a package you didn’t order, it might be a brushing scam. Here’s how to protect yourself:
- Check your accounts. Log into your accounts on popular shopping sites, like Amazon. Check your order history and make sure that no one has hacked your account or used it to place an order.
- Check your transactions. Check your debit and credit card statements to verify that you haven’t been hacked or paid for the purchase. If you suspect your card information has been stolen, contact your credit card provider immediately.
- Change your passwords. Take a few minutes to change the passwords on your shopping accounts, especially if anything looks suspicious.
- Turn on two-factor authentication. Enable two-factor authentication on your shopping and finance accounts for an extra level of protection against fraud.
- Check your credit reports. If your address has been exposed in a data breach, other information may also be jeopardized. Check your credit reports for any unfamiliar accounts or activity.
- Report the package. Contact the retailer or marketplace to report the package, but don’t follow any QR codes or instructions inside of the package.
- Contact the FTC. You can report suspected package fraud to the FTC using the Report Fraud website.
- Request a review removal. If the scammer has posted a fake review under your name, contact the marketplace and request that it be removed.
- Dispose of contents appropriately. Many packages contain cheap items that you can dispose of. However, if it contains seeds, plants, foods, liquids or another substance that might be unsafe, follow agency guidance regarding the best disposal method. The USPS recommends that if you receive organic materials or unknown substances, you should contact the proper authorities, such as your state’s Department of Agriculture.
Can identity theft protection help after a brushing scam?
Receiving an unsolicited package doesn't necessarily mean your identity has been stolen. But if your personal information has been exposed, you may want to monitor for signs that it is being used elsewhere.
Identity theft protection services can help with some of that monitoring. Coveron, for example, offers dark web monitoring that looks for exposed personal information, including email addresses, phone numbers and Social Security numbers. Depending on the plan, it also offers credit monitoring, financial account monitoring and alerts that could help you spot suspicious activity.
Competitors such as Aura, IDShield and McAfee+ also offer identity and credit monitoring, though the specific features, number of credit bureaus monitored, insurance coverage and additional security tools vary by provider and plan. Compare the monitoring features you're most likely to use as well as the price before signing up.
Keep in mind that an identity theft protection service can't prevent someone from sending you a brushing package or guarantee that your information won't be exposed. Its value in this situation is monitoring for additional warning signs and, depending on the service, providing assistance if someone actually uses your information to commit fraud.
Do you have to return something you didn't order?
Under Federal law, consumers can generally treat unordered merchandise as a gift, meaning you don’t have to pay for or return the merchandise. Alternatively, if you receive a package via the USPS and it has a return address, you can mark the unopened package "RETURN TO SENDER" and the USPS will ship it back at no charge to you.
Just because you’re allowed to keep a package you didn’t order doesn’t mean you should use it. You don’t know where it came from or if it’s safe, so it’s best to be cautious regarding anything you’ve received.
Most importantly, a package scam may indicate that your personal information has been compromised online. If you receive a package you didn’t order, then consider tightening up your online protections, checking your account activity and closely monitoring your credit and debit accounts for any unauthorized activity.
Related content
-
QQQ vs SPY: What $1,000 Invested 20 Years Ago Is Worth NowMega-cap tech and communications stocks deliver outsized rewards — and greater risk.
-
How to Use AI to Help Your Holiday ShoppingFrom saving money to picking the best gifts, tech can lend a hand this season — if you feed it the right information first.
-
As Rates Rise, Tapping Home Equity Gets TrickierWringing cash from your house can still make sense, but you need to take extra care to nab the best deal on a new loan.
-
How to Use AI to Help Your Holiday Shopping
From saving money to picking the best gifts, tech can lend a hand this season — if you feed it the right information first.
-
As Rates Rise, Tapping Home Equity Gets Trickier
Wringing cash from your house can still make sense, but you need to take extra care to nab the best deal on a new loan.
-
The Giving Advantage: How Generosity Can Also Be a Smart Financial MoveIf charitable giving is on your to-do list as year-end approaches, there are several ways you can maximize your impact while doing your own finances some good.
-
My First $1 Million: Retired Banking VP, 70, Bexley, Ohio"I enjoyed the journey. The challenge of selecting and making good investments kinda fed on itself over the years."
-
Skip the Snow: 5 Warm-Weather Family Getaways for ChristmasTrade snow for sunshine this Christmas. Learn about five warm-weather family getaways, festive activities and ways to save on your holiday vacation.
-
Buying Your Own Health Insurance? Bronze and Catastrophic Plans Now Open the Door to HSAsHSAs can be a useful tax-advantaged savings channel for business owners and the self-employed, and more people are eligible this year than ever.
-
4 Financial Mistakes That Can Haunt Your WalletOverlooked financial mistakes can haunt you for years. Here are some of the most common ones and ways to avoid them.
-
When Is Using Your Car for a Side Hustle Actually Worth It?Before you turn the ignition on a side gig, figure out whether your car will actually make you money — or end up costing you more.
