You open the door and find a package addressed to you. You do not remember ordering it. Inside is something cheap and random.
It is tempting to laugh, throw it away, or scan the QR code on the note that came with it. That last step is exactly where things can get interesting.
The FTC warned in August 2026 that unexpected packages can be part of a brushing scam. In this scheme, a seller sends merchandise to someone who did not order it, then uses the delivery as evidence to create fake reviews or improve the appearance of its sales activity. An unexpected package can also indicate that someone has obtained personal information.
Why would a scammer send you something for free?
The package itself may not be the main target. The scammer may want proof that a real person at a real address received something. That information can be useful for manipulating marketplace systems or creating fake customer activity.
There is another risk: the package may contain a card or QR code telling you to scan it to identify the sender or arrange a return. A QR code can lead to a phishing site designed to steal login or payment information.
Do not scan the QR code just because the package looks legitimate
A familiar logo does not prove the message is genuine. If you want to investigate the shipment, go directly to the marketplace or delivery company’s official website or app instead of using the link or QR code inside the package.
What should you do?
- Do not pay for it. Be suspicious of anyone who asks for a fee to release or return an unsolicited package.
- Do not scan unexpected QR codes. If you need information, open the official app or type the known website address yourself.
- Check your shopping accounts. Look for unfamiliar orders, saved addresses, payment methods, or recent account changes.
- Change passwords if anything looks wrong. Start with your marketplace and email accounts, especially if you see unfamiliar activity.
- Turn on MFA. This gives important accounts another layer of protection if a password has been exposed.
- Monitor your credit. The FTC recommends checking your credit regularly for signs of identity theft.
- Report suspicious activity. Contact the marketplace and report fraud to the FTC when appropriate.
What if you never ordered the item?
Do not feel pressured to send money or provide personal information simply because a package arrived at your address. The FTC says consumers do not have to pay for merchandise they did not order, and the law generally does not require consumers to return unordered merchandise.
That does not mean every unexpected package is automatically a scam. Someone could have sent you a gift, a retailer could have made an error, or a shipment could have been misdelivered. The important distinction is whether someone is trying to use the surprise delivery to make you click, pay, log in, or reveal information.
The five-second test
Before interacting with a surprise package, ask:
- Did I actually order this?
- Is anyone asking me to scan something?
- Is anyone asking for money or personal information?
- Did I recently receive a suspicious email or message?
- Do my shopping accounts show an order I do not recognize?
If the answers make you uncomfortable, slow down. A few minutes of checking through an official app is cheaper than recovering a stolen account.
Source: Federal Trade Commission consumer guidance on brushing scams and unexpected packages.