It’s a scenario that's becoming more common: You arrive home to find a package on your porch. Your name and address are on the package, but you didn’t order it and no one in your household recognizes it.
Don’t assume that it’s simply a shipping mistake — you might be dealing with a brushing scam. Brushing scams, also known as package scams, are becoming so common that the Federal Trade Commission (FTC) posted a warning about the scams in August.
The packages received in a brushing scam often contain a cheap item, and sellers send them so they can create fake verified reviews. The cheap item isn’t necessarily the problem; the bigger concern is how the sender got your information.
From just $107.88 $24.99 for Kiplinger Personal Finance
Become a smarter, better informed investor. Subscribe from just $107.88 $24.99, plus get up to 4 Special Issues
Sign up for Kiplinger’s Free Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
What is a brushing scam?
In a brushing scam, a seller sends an inexpensive product to a real person’s address, so delivery is confirmed and the purchase appears legitimate. The seller covers the cost of the product, so you never receive a bill.
Once the delivery is confirmed, the seller may use your identity to create a fake "verified" review to help artificially boost the product’s reputation, leading to more real sales. According to the USPS, brushing is illegal in the U.S.
To pull off the scam, scammers need genuine names and addresses, which they may get through a data breach or illegal database. That information might include compromised or publicly available data.
If you receive a package in a brushing scam, it may mean that your name and address have been compromised in a data breach. However, that doesn’t automatically mean the scammer has your Social Security number, bank account information or full identity.
If you're concerned that other personal information has been exposed, identity protection services such as Coveron and LifeLock can monitor for signs of compromised information, including data found on the dark web. These services won't prevent a brushing scam, but they can alert you to other potential risks involving your personal information.
Don't scan a QR code inside the package
A new "quishing" variation adds another layer of risk to the scam. Some scammers are sending out packages including a card with a QR code; the card might instruct you to scan the code to return the item, or it might include a message like, “Scan to see who sent your gift.”
The QR code may direct victims to a phishing website designed to capture usernames, passwords, credit card information, birthdates, Social Security numbers, or other sensitive information. According to the FBI, QR codes in unsolicited packages might also lead to malicious software that could steal data from the victim’s phone.
If you receive an unsolicited package, don’t scan any QR codes that it might contain.
What to do if you receive a package you didn't order
If you receive a package you didn’t order, it might be a brushing scam. Here’s how to protect yourself:
- Check your accounts. Log into your accounts on popular shopping sites, like Amazon. Check your order history and make sure that no one has hacked your account or used it to place an order.
- Check your transactions. Check your debit and credit card statements to verify that you haven’t been hacked or paid for the purchase. If you suspect your card information has been stolen, contact your credit card provider immediately.
- Change your passwords. Take a few minutes to change the passwords on your shopping accounts, especially if anything looks suspicious.
- Turn on two-factor authentication. Enable two-factor authentication on your shopping and finance accounts for an extra level of protection against fraud.
- Check your credit reports. If your address has been exposed in a data breach, other information may also be jeopardized. Check your credit reports for any unfamiliar accounts or activity.
- Report the package. Contact the retailer or marketplace to report the package, but don’t follow any QR codes or instructions inside of the package.
- Contact the FTC. You can report suspected package fraud to the FTC using the Report Fraud website.
- Request a review removal. If the scammer has posted a fake review under your name, contact the marketplace and request that it be removed.
- Dispose of contents appropriately. Many packages contain cheap items that you can dispose of. However, if it contains seeds, plants, foods, liquids or another substance that might be unsafe, follow agency guidance regarding the best disposal method. The USPS recommends that if you receive organic materials or unknown substances, you should contact the proper authorities, such as your state’s Department of Agriculture.
Can identity theft protection help after a brushing scam?
Receiving an unsolicited package doesn't necessarily mean your identity has been stolen. But if your personal information has been exposed, you may want to monitor for signs that it is being used elsewhere.
Identity theft protection services can help with some of that monitoring. Coveron, for example, offers dark web monitoring that looks for exposed personal information, including email addresses, phone numbers and Social Security numbers. Depending on the plan, it also offers credit monitoring, financial account monitoring and alerts that could help you spot suspicious activity.
Competitors such as Aura, IDShield and McAfee+ also offer identity and credit monitoring, though the specific features, number of credit bureaus monitored, insurance coverage and additional security tools vary by provider and plan. Compare the monitoring features you're most likely to use as well as the price before signing up.
Keep in mind that an identity theft protection service can't prevent someone from sending you a brushing package or guarantee that your information won't be exposed. Its value in this situation is monitoring for additional warning signs and, depending on the service, providing assistance if someone actually uses your information to commit fraud.
Do you have to return something you didn't order?
Under Federal law, consumers can generally treat unordered merchandise as a gift, meaning you don’t have to pay for or return the merchandise. Alternatively, if you receive a package via the USPS and it has a return address, you can mark the unopened package "RETURN TO SENDER" and the USPS will ship it back at no charge to you.
Just because you’re allowed to keep a package you didn’t order doesn’t mean you should use it. You don’t know where it came from or if it’s safe, so it’s best to be cautious regarding anything you’ve received.
Most importantly, a package scam may indicate that your personal information has been compromised online. If you receive a package you didn’t order, then consider tightening up your online protections, checking your account activity and closely monitoring your credit and debit accounts for any unauthorized activity.
Related content
-
How Much Money Should You Put in a CD?CDs offer guaranteed returns, but locking up too much cash can leave you short when you need it. Here's how to find the right amount.
-
Grandparents' Guide to 529 Plans for College and Private SchoolK-12 tuition, tax breaks, and Roth IRA rollovers: How grandparents can make the most of a 529 plan.
-
Medicare Supplement Rates: How to Save MoneyYour Medigap plan could be much cheaper with another carrier. It's easier than you might think to switch — but beware of the timing trap that can trip you up.
-
Grandparents' Guide to 529 Plans for College and Private School
K-12 tuition, tax breaks, and Roth IRA rollovers: How grandparents can make the most of a 529 plan.
-
You Can Save Hundreds on Your Medicare Supplement Plan Premium by Shopping Around, But Your Timing Is Key
Your Medigap plan could be much cheaper with another carrier. It's easier than you might think to switch — but beware of the timing trap that can trip you up.
-
How Much Does It Cost to Install Fiber Internet?Fiber internet installation and equipment don't always cost extra. Here's what to check before switching providers.
-
How to Keep an Inheritance From Tearing You and Your Siblings ApartInheritance can create tension between siblings. Financial therapists share practical ways parents and adult children can prevent conflict before it starts.
-
3 Ways to Budget Your Money — Which Method Is Right for You?There’s more than one way to manage your money. These three budgeting methods offer different levels of structure depending on your spending habits and financial goals.
-
Treasury Yields Are Rising. Here's What That Could Mean for Your Mortgage, Car Loan and Credit CardsThe 10-year Treasury yield is climbing. Here's how higher yields could affect mortgage rates, car loans and credit card debt.
-
Before You Dive Into a Side Gig, Consider These IssuesTaking on a side hustle to boost earnings? It may be better to spend time and energy growing your career or pursuing work that aligns with long-term goals.
-
3 Ways to Save at Verizon: Bring Your Phone, Buy New or UpgradeVerizon offers different ways to save depending on whether you keep your phone, buy a new one or upgrade. Here's how the deals compare.
