The Brushing Scam! Getting Packages You Never Ordered? Here's What's Really Going On
The Brushing Scam! Getting Packages You Never Ordered? Here's What's Really Going On
You come home and find a package on your doorstep. Your name is on it. But you never ordered anything. You open it and find something random — cheap jewelry, face masks, seeds, a Bluetooth speaker, or beet supplements. Your first thought is excitement — free stuff! But before you enjoy your unexpected gift — read this. That package is a warning sign that something serious may be happening with your personal information.
What Is a Brushing Scam?
A brushing scam is when an online seller sends you an item you didn't order so they can post a fake "verified purchase" review under your name. These scams usually involve low-value items like cheap jewelry seeds or trinkets.
The name comes from the Chinese term "shua dan" — which means to "brush" or boost a seller's sales numbers. These sellers are literally brushing up their reputation using your name and address without your knowledge or permission.
Brushing scams are illegal in the U.S. and many other countries — but they have seen a sudden nationwide surge in 2025 and 2026.
Why Would Anyone Send You Free Stuff?
This is the question everyone asks — and the answer will surprise you.
Dishonest sellers use brushing scams to manipulate their reviews inflate visibility and trust and boost sales on popular marketplaces like Amazon eBay or AliExpress.
Here's exactly how it works:
Step 1: A scammer gets your name and address — usually from a data breach, the dark web, or by purchasing stolen data.
Step 2: They create a fake buyer account using your name and details on Amazon, Temu, or another marketplace.
Step 3: They use that fake account to "purchase" their own products — creating what looks like a real verified sale.
Step 4: They ship the cheapest possible item to your real address — confirming the "delivery."
Step 5: They post a glowing five-star review under your name — "verified purchase" — boosting their product's ranking and making it appear more trustworthy.
Step 6: More real customers buy their product because of the fake five-star reviews — generating real profit.
This scheme is profitable for the scammer because high ratings increase sales and the products sent out are cheaply produced and easy to ship — making it profitable even when sending thousands of packages.
Real Stories — It's Happening Everywhere
Ray Simmons was baffled when an Amazon package containing beet chews landed on his doorstep. "I did think that maybe someone in my family was playing a joke on me — that they were telling me I needed to eat healthier." But the package wasn't a joke. Simmons had unwillingly become the target of a brushing scam.
Isabel Wood a 27-year-old woman living outside of Chicago told Inside Edition that cat perfume was the most unusual among the hundreds of items that had been coming to her doorstep. The mystery gifts also included hats belts and a karaoke machine — all from Temu a Chinese e-commerce company.
A Bay Area woman named Janet Brewer received a plastic package postmarked from China. Inside was a pack of seeds. She didn't think much about it because she had coincidentally ordered seeds from Amazon in June. It wasn't until she read an article about mysterious seed packets that she realized these weren't the seeds she ordered. She logged into her Amazon account and saw her real order wasn't expected until August. "Called my husband and said honey you have to see this. And it was like oh my God how widespread is this?"
The Items People Most Commonly Receive
Brushing scam packages typically contain items that are extremely cheap and lightweight — making them inexpensive to ship in bulk:
- Cheap rings or bracelets
- Face masks or beauty products
- Seeds — especially from overseas
- Ping pong balls
- USB drives ← especially dangerous
- Bluetooth speakers
- Hand warmers or flashlights
- Beet chews or vitamins
- Phone cases
- Small kitchen gadgets
- Computer accessories
- Crawfish traps and other bizarre items
Brushing scams have seen a sudden nationwide surge. Items are often lightweight and inexpensive to ship like ping pong balls face masks or seeds from China.
🚨 The New Dangerous Twist in 2026 — The QR Code Inside the Package
This is something new that has appeared in 2026 — and it turns a relatively harmless scam into a genuinely dangerous one.
Scammers are now mailing out random packages from Amazon or other retailers that people did not order. Inside there may be a note asking you to scan a QR code to "see who sent it" "claim a reward" or "thank the sender." Scanning the QR code may take you to a fake website that steals your personal and financial information. Some QR codes can install malware on your phone or device.
The rule is simple and absolute: Never scan a QR code that comes inside a package you didn't order. Not even to find out who sent it.
🚨 The Seeds Warning — A Special Danger
If you receive seeds in the mail that you didn't order — especially seeds from overseas — do NOT plant them.
The Canadian Food Inspection Agency warned gardeners not to plant any seeds received in the mail without ordering — warning that they could be harmful to the environment. "These unauthorized seeds could be from invasive plants or they could even carry plant pests" said the agency which also asked people not to compost the seeds or throw them in the garbage where they could sprout.
If the merchandise is organic — seeds food plants or an unknown liquid or substance — notify the proper authorities and follow their instructions.
If you receive seeds you didn't order:
- Do NOT plant them
- Do NOT compost them
- Do NOT throw them in your regular garbage where they could sprout
- Contact the USDA at 1-800-877-8339 or your state's agriculture department
- Place them in a sealed plastic bag and follow official disposal instructions
Why This Is More Serious Than It Looks
Most people's first reaction to receiving free stuff is excitement. Here's why that reaction should actually be concern:
Being part of a brushing scam means your personal data has very likely been exposed in a data leak or sold illegally. If someone has your name and address they may also have other personal information that could lead to identity theft and account takeovers.
Think about what it means that a stranger has your full name and correct home address:
- They likely got it from a data breach
- They may also have your email, phone number, and date of birth
- They may have already sold your information to other criminals
- Your accounts may be at risk right now
Once this information is online it could be used for numerous illicit activities.
The Porch Pirate Danger
There's one more angle to this scam that most people don't think about:
Another angle to this scam is the "porch pirate" tactic where thieves use others' addresses and accounts wait for the delivery and steal the package before the resident gets it.
A scammer places an order using your address — but instead of the delivery being part of the fake review scheme — they or an accomplice are watching your home to steal the package before you get it. You end up with an unauthorized charge on your account and they get the item.
Always check your online shopping accounts if you receive a package you didn't order — to make sure there are no unauthorized orders charged to your account.
What to Do If You Receive a Package You Didn't Order
Follow these steps carefully:
Step 1 — Don't panic — but do take it seriously You are not in legal trouble. You don't have to pay for anything. But you do need to take some protective steps.
Step 2 — Verify it's not a gift first Before doing anything else — check with family members and friends. Could someone have sent you a surprise gift? If yes — mystery solved! If no — continue to the next steps.
Step 3 — Do NOT scan any QR code inside the package Scanning the QR code may take you to a fake website that steals your personal and financial information. Some QR codes can install malware on your phone or device.
Step 4 — Keep the item or dispose of it safely You are under no legal obligation to pay for or return it. If marked with a return address and it is unopened you may mark it "Return to Sender" and USPS will return it at no charge to you. If you opened it and do not wish to keep it you may simply dispose of it — as long as it is safe to do so.
Do NOT use or consume:
- Any food or supplements — they may be expired counterfeit or unsafe
- Any cosmetics or beauty products — may contain harmful ingredients
- Any seeds — plant safety risk
Step 5 — Check your online shopping accounts immediately Log into Amazon, Temu, Walmart, and any other shopping accounts you use. Check for:
- Any orders you don't recognize
- Any new addresses added to your account
- Any payment methods you don't recognize
- Any reviews posted under your name that you didn't write
Some platforms may temporarily flag or freeze your account if someone posts fake reviews under your name.
Step 6 — Change your passwords Update your passwords for your shopping account and linked email. Enable two-factor authentication for added security.
Step 7 — Check if your email was in a data breach Go to haveibeenpwned.com — type in your email address and it will tell you if your information was exposed in any known data breach. This is free and takes 30 seconds.
Step 8 — Report it
To Amazon: Log into your Amazon account → Click Help → Report a problem. Amazon will investigate and can take action against the scammer including suspending their selling privileges.
To Temu: Contact Temu customer service directly and report the unsolicited package.
To the FTC: Report at reportfraud.ftc.gov — your report helps the FTC track these scams nationally.
To the U.S. Postal Inspection Service: Report at postalinspectors.uspis.gov — they investigate mail fraud.
If you received seeds: Contact the USDA at 1-800-877-8339
How to Protect Your Personal Information Going Forward
Since brushing scams happen because your information was exposed — here's how to better protect yourself:
Freeze your credit: A credit freeze prevents anyone from opening new accounts in your name even if they have your personal information. It's completely free at all three credit bureaus — Equifax, Experian, and TransUnion.
Check your credit report regularly: Go to annualcreditreport.com — you're entitled to free reports from all three bureaus. Check for any accounts you don't recognize.
Be careful about where you share your address: Every time you enter your address on a new website — that information could eventually be exposed in a breach. Limit who has your personal information and always use strong unique passwords for shopping accounts.
Monitor your accounts: Closely monitor your credit reports and credit card bills for any suspicious activity after receiving a package you didn't order.
💡 Golden Tips From Real People
"My first instinct was to keep the free stuff — then I read about brushing scams and immediately checked my accounts." Real people consistently say the same thing — free stuff feels exciting until you understand what it actually means. Check your accounts first.
"I found a fake review posted under my name on Amazon. I reported it immediately and Amazon removed it within 24 hours." Amazon takes brushing scams seriously and acts quickly when reported. Always report — don't just ignore it.
"The QR code inside was what really scared me. I almost scanned it." The QR code twist is the most dangerous new development. Real people are sharing this warning everywhere — never scan a QR code from a package you didn't order.
"I went to haveibeenpwned.com and found my email had been in 6 data breaches. That explained everything." This free tool is eye opening. Many people discover their information has been compromised in breaches they never heard about — often years ago.
"I changed all my passwords after receiving an unexpected package — and found someone had tried to log into my email." Acting quickly on password changes after receiving an unexpected package can prevent further damage. Don't wait.
"The seeds from China scared me the most — I didn't know they could be invasive plants." The agricultural danger of foreign seeds is real and something most people never think about. Never plant seeds that arrive unexpectedly.
The Complete Brushing Scam Action Checklist
If you receive a package you didn't order — work through this list:
- ✅ Ask friends and family if it could be a gift
- ✅ Do NOT scan any QR code inside the package
- ✅ Do NOT consume any food supplements or beauty products
- ✅ Do NOT plant any seeds — contact USDA instead
- ✅ Check all your online shopping accounts for unauthorized orders
- ✅ Change your passwords on all shopping and email accounts
- ✅ Enable two-factor authentication on your accounts
- ✅ Go to haveibeenpwned.com and check your email
- ✅ Report to Amazon Temu or the relevant marketplace
- ✅ Report to the FTC at reportfraud.ftc.gov
- ✅ Monitor your credit card and bank statements
- ✅ Consider placing a credit freeze
The Golden Rule
A package you didn't order is never just a lucky surprise. It means someone has your personal information and is using it without your permission. Act immediately — check your accounts, change your passwords, and report it. The free item is the smallest part of the problem.
Have you ever received a package you didn't order? Share what was inside and what you did about it in the comments below — your experience could help someone else recognize this scam!
Comments
Post a Comment