You received a package you didn't order — the sender posted a fake review in your name
Sellers send you packages you never ordered using your real name, then post fake 5-star reviews in your name to boost their ratings. Newer packages include a QR code that links to a phishing page or malware download when scanned.
Also known as: brushing scam, unsolicited package scam, fake review fraud, mystery package scam
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Do not scan any QR code inside an unexpected package — it may link to a phishing page or install malware
- 2 Do not click links or call numbers on notes inside the package claiming to identify the sender
- 3 Check your accounts: a brushing sender obtained your address — change passwords on shopping accounts and check for unauthorized activity
- 4 Freeze your credit at Equifax, Experian, and TransUnion if you believe your data was exposed — it's free at annualcreditreport.com
- 5 You can keep the package legally — you have no obligation to return it
- 6 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.
Red flags
- ⚠ You receive a package you never ordered from an unknown sender
- ⚠ The package contains something cheap and random — baby wipes, seeds, a USB drive, toothpaste
- ⚠ There is no return address, invoice, or sender information
- ⚠ A note or sticker inside says 'scan the QR code to find out who sent this' or 'scan to process a return'
- ⚠ A 5-star review of the shipped product appears online in your name soon after
- ⚠ The sender used your correct name and address — a sign your personal data was exposed in a breach
Brushing scams hurt in two ways: your personal data is in the hands of strangers (they got your real name and address somewhere), and your identity is being used to inflate someone’s fake ratings. The package itself is not valuable — it’s just the physical “proof of delivery” a scammer needs to post a “verified” review.
The QR-code variant is the nastier upgrade: instead of merely exploiting your name for a review, the scammer is now actively trying to get onto your phone. An unsolicited package with a QR code is the new phishing email — treat it the same way.
Known variants
-
A QR code inside the unsolicited package says 'scan to find who sent this' or 'scan to process a return.' Scanning opens a phishing page that harvests personal or financial information, or triggers a malware download on the victim's phone.
Last seen: 8/21/2026