Got a package you didn't order? You can keep it, but watch for a brushing scam
A box arrives with your name on it: phone cases, seeds, a cheap gadget, and you never ordered any of it. You don't owe anyone money for it. But that "free" package can also be a sign that your name and address are being used in a fake-review scheme.
- Under 39 U.S.C. 3009, merchandise mailed without your request may be treated as a gift; the sender can't bill you or send collection notices.
- Surprise packages are often brushing scams: a seller ships cheap items to post fake verified reviews in your name.
- Don't pay, don't scan QR codes in the box, report it to the marketplace, and check your accounts.
What the law says
Under 39 U.S.C. 3009, Mailing of unordered merchandise, mailing unordered merchandise (other than clearly marked free samples or items from charities asking for donations) is an unfair trade practice. The key line for shoppers: such merchandise "may be treated as a gift by the recipient, who shall have the right to retain, use, discard, or dispose of it in any manner he sees fit without any obligation whatsoever to the sender." The sender also can't mail you a bill or "any dunning communications" for it. "Unordered" means sent without your prior expressed request or consent.
That doesn't cover things you did agree to, like a subscription you signed up for or a free trial that converts to paid (see free trials and subscriptions). And if a package is simply addressed to someone else, it isn't yours to keep; return it or tell the carrier.
Why it might be a brushing scam
The U.S. Postal Inspection Service: Brushing Scam explains the pattern: you get items you didn't order, often with no return address or a retailer's return address, usually from an overseas third-party seller who found your address online. The goal is to make it look like you are a verified buyer so they can post fake positive reviews in your name. A newer twist puts a card with a QR code in the box ("scan to see who sent your gift") that leads to a fake site built to steal personal information.
What to do
- Don't pay for it or respond to any request for money.
- Unopened with a return address? USPIS says you can mark it "Return to Sender" and USPS will return it free.
- Opened? You can keep it or throw it away if it's safe. If it's seeds, plants, food or an unknown liquid, notify the proper authorities and follow their instructions.
- Don't scan QR codes or follow links included in the package.
- Report it to the marketplace it came from (Amazon, eBay or another seller site) and ask them to remove any reviews posted under your name.
- Change your passwords and watch your credit reports and card statements; your information may have been exposed. A credit freeze is free.
Related: how to prevent package theft and how to spot fake shopping sites.
Published October 29, 2026. We do not use affiliate links on this page; see our Affiliate Disclosure.