## Intro
You didn't order anything. Nobody in your house ordered anything. But there's a package on your doorstep with your name on it — and inside, a cheap phone charger, a packet of seeds, or a tube of toothpaste you have no use for. Some people get one. Some get a dozen.
This is a **brushing scam**, and in August 2026 the U.S. Federal Trade Commission issued a consumer alert about it — because the version circulating now has a new twist that can actually cost you money: a small printed card with a QR code, inviting you to "see who sent your gift" or "start a return."
Here's what a brushing scam is, why you're the target, what that QR code really leads to, and exactly what to do with the package and your accounts.
## 1. What a brushing scam is
A brushing scam is a review-fraud scheme, not a shipping error. An unscrupulous marketplace seller — usually a third-party seller on Amazon or a similar platform — needs something no honest seller has: reviews that look like they come from real buyers. So the seller creates fake buyer accounts, attaches your real name and address to them, and ships something cheap to your door.
The package is the camouflage. The product is the fraud.
Police departments and consumer agencies have been warning about brushing for years, but it keeps working because it exploits something simple: shoppers trust "verified purchase" reviews more than ordinary ones, and sellers who can manufacture that trust signal win sales. An Arizona couple made national news in May 2026 after receiving dozens of unordered packages — oven mitts, curtains, dog nail clippers — with fake names on the labels, all of it brushing merchandise.
## 2. How the scam works, step by step
Understanding the mechanics takes the mystery out of the package:
1. **The seller harvests addresses.** Your name and address come from a data breach, a sold customer list, or scraped public records. It's sitting in a spreadsheet somewhere.
2. **Fake buyer accounts are created** using your name and address — on Amazon, eBay, Temu, or wherever the seller operates.
3. **A "purchase" is made** through each fake account. The seller is buying their own product, so the money never actually leaves their control.
4. **Something cheap is shipped to you** — seeds, wipes, cables, trinkets. The actual product being reviewed usually never ships; sending the cheap item is all the seller needs to generate a tracking number.
5. **A glowing review appears** under the fake account's "verified purchase" badge — the most trusted review signal on the page.
6. **You receive junk** and wonder what's going on. The seller gets a review that can influence thousands of real buyers.
Amazon prohibits third-party sellers from sending unsolicited packages and says violators may lose selling privileges, have payments withheld, and be referred to law enforcement. But with millions of third-party listings across amazon.com, amazon.co.uk, amazon.de, amazon.fr and other marketplaces, brushing keeps slipping through.
## 3. The real target: fake "verified purchase" reviews
Here's why a brushing scam belongs on a review-safety site: the package is just logistics. The actual product of the scheme is **fake verified-purchase reviews**.
The "verified purchase" badge exists to solve a hard problem — anyone with an account can review anything, so the badge was supposed to mark reviews from people who genuinely bought the item. Brushing games that exact signal: because a real shipment went to a real address, the platform's systems treat the review as legitimate. The buyer never existed, but the badge does.
That means a product page can be stacked with five-star "verified" reviews while the people listed as reviewers have never heard of the product — they're people like you, holding mystery packages. If you shop by the stars, you're shopping by the brushers' output. Run the product link through our **fake review checker** before you buy: brushing reviews leave patterns — clusters of vague five-star ratings, reviewers whose only reviews are for one seller's products — that show up in the data even when they fool the badge.
## 4. The 2026 twist: the QR code card that can cost you money
The classic brushing package is harmless — unwanted, but harmless. The 2026 version added something dangerous: a small printed card, often with friendly wording like "A gift for you — scan to see who sent it," "scan to start your return," or "scan to register your warranty."
**Do not scan it.** The FTC's August 2026 alert and police warnings are explicit about this: the code typically leads to a phishing site built to steal your login credentials, credit card numbers, or other personal data — or it can push malware onto your phone. The Wytheville, Virginia police department warned residents in 2026 about exactly these QR-code brushing packages after a wave of them in their area.
This is the escalation path. The package gets you curious; the card turns curiosity into a credential theft. Also ignore any phone numbers printed on the package or card — calling "customer service" about your mystery gift connects you to the scammers, not to Amazon.
## 5. What the package tells you about your personal data
Getting a brushing package is, at minimum, evidence that your name and home address are in a scammer's spreadsheet — and possibly in many of them, since address lists are traded and re-sold. That's the part most victims miss: the package is not the problem; it's the symptom.
Treat it as a prompt to tighten up:
- **Check your marketplace accounts** for orders you didn't place, new shipping addresses, or reviews written in your name. On Amazon, check archived orders too — brushers don't use your account, but compromised accounts produce the same symptoms.
- **Change passwords** on your shopping accounts and turn on two-factor authentication where it's offered.
- **Watch your bank and card statements** for charges you don't recognize. Brushing itself rarely involves a charge to you — the seller pays for the cheap item — but the same data can be reused for account-takeover or card fraud.
- **Don't confirm your details to anyone.** No legitimate company will call, text, or email you to "verify" your address about a package you didn't order. Anyone asking is part of the scam.
## 6. Your rights: you can keep the package
Good news, and it's the law on both sides of the Atlantic: **you don't owe anything for goods you never ordered.**
- **United States:** The FTC and the U.S. Postal Inspection Service are clear — unsolicited merchandise is yours. Keep it, throw it away, or donate it. You are not required to pay for it or return it.
- **European Union:** EU consumer law exempts consumers from any obligation to pay for unsolicited supply (Consumer Rights Directive 2011/83/EU). Consumer Europe's guidance adds a practical note: you're not liable, and if a trader asks for the item back, any return must be at their expense. For cross-border cases — say a package from a non-EU seller — the European Consumer Centre network (ECC-Net) can advise.
One caution for European shoppers: if you actually *use* the product in some countries, that can be treated as accepting a contract — so don't plug in, install, or consume anything questionable. And one caution everywhere: if the package contains seeds, soil, plants, or unknown substances, don't plant them and don't open them further — report them to your national agricultural or environmental authority. Mislabeled organic shipments are a biosecurity problem as well as a scam.
## 7. What to do when a brushing package arrives: the checklist
Follow these in order:
1. **Check it's really a mystery.** Ask your household first, and check your order history (including archived orders) before assuming it's brushing.
2. **Don't scan anything.** No QR codes, no barcodes, no links on cards inside the package.
3. **Photograph the evidence.** The shipping label, tracking number, packaging, and contents — before you throw anything away. This helps if you report it.
4. **Don't send anything back or pay anything.** You owe nothing. Returning it on your own dime rewards the scammer's business model.
5. **Report it to the marketplace.** Contact Amazon (or whichever platform the shipment came from) through the app or website — not through any number on the package. Amazon investigates seller abuse and can remove fake reviews written in your name.
6. **Check your accounts.** Review recent orders, saved addresses, and reviews posted under your name; change passwords and enable two-factor authentication.
7. **Watch your statements** for unfamiliar charges over the next few weeks.
8. **Report it officially.** In the US: the FTC at reportfraud.ftc.gov and the U.S. Postal Inspection Service. In the UK: Action Fraud. In the EU: your national consumer authority or ECC-Net for cross-border cases.
## 8. Protecting yourself from the next wave
Brushing activity follows the money — it intensifies around shopping peaks, when sellers are desperate to climb the rankings for Singles Day (November 11), Black Friday (November 27), and the Christmas season. A few standing habits:
- **Shop the pattern, not the badge.** Before trusting a product page, look at review timing (a burst of five-stars around launch), reviewer history (accounts that only review one seller's products), and the one- and two-star reviews, which brushing can't easily fake away.
- **Treat "verified purchase" as one signal, not proof.** Brushing exists precisely because the badge can be manufactured. Independent review patterns — and tools like our fake review checker — are the second opinion.
- **Keep delivery addresses lean.** Some shoppers use Amazon lockers or pickup points for marketplace orders, so their home address circulates less. It won't stop brushing, but it narrows the data trail.
- **Teach the household.** The person most likely to scan a mysterious QR code isn't you — it's a family member who opens the package first. Make "never scan a code from a package we didn't order" a household rule, especially with kids and older relatives.
## Closing + CTA
A brushing scam is flattering in a strange way: a scammer spent money to send *you* something, because your address was useful. But the package is the least interesting part. The interesting part is the review it bought — a fake five-star "verified purchase" endorsement now sitting on a product page, steering real shoppers toward a real purchase with fake evidence.
You can keep the toothpaste. Just don't scan the card. And the next time a product page's glowing reviews feel a little too perfect, paste the link into our **fake review checker** before you buy — brushing reviews have a fingerprint, and it's worth finding before your money is in the cart. Shopping on an unfamiliar store altogether? Run it through our **website scam checker** first.
---
**Sources:** FTC brushing-scam consumer alert (August 2026, via Shieldr 2026-10-13 and ScamDrill 2026-08-22); U.S. Postal Inspection Service guidance on unsolicited merchandise; Wytheville, VA police brushing-scam QR-code warning (2026); WVLT/Gray Media — Arizona couple brushing case (May 2026); CNN Business explainer on brushing and fake verified-purchase reviews; Amazon policy on unsolicited packages; EU Consumer Rights Directive 2011/83/EU Article 27 (unsolicited supply); Consumer Europe unsolicited-products checklist.
Explore the evidence behind your next question.
Start a website check