What to Do If You Receive a Package You Never Ordered

Have you ever arrived home to find a mysterious package sitting on your doorstep? You check the label, but you didn’t order it. You ask your family members, but they are just as confused as you are. Receiving an unsolicited package can feel unsettling, even alarming. Is it a gift? A mistake? Or, more concerningly, could it be part of a sophisticated scam?

In the age of online shopping, where packages arrive at our doors daily, it is easy to become complacent. However, receiving items you never purchased is a red flag that requires your immediate attention. In this guide, we will break down exactly what this phenomenon is, why it happens, and the concrete steps you need to take to protect your privacy, finances, and personal identity.

What is a “Brushing” Scam?

One of the most common reasons you might receive an unordered package is a deceptive practice known as a “Brushing” scam.

At its core, a brushing scam is a scheme used by unscrupulous third-party sellers on large e-commerce platforms to artificially boost their product ratings. To become a “verified” seller and achieve high rankings in search results, these sellers need positive reviews.

Here is how the scam works:

1. Obtaining Data: The seller illegally obtains your name, address, and sometimes your phone number—often from data breaches or by purchasing stolen information on the dark web.

2. Creating Fake Accounts: The seller creates a fake customer account using your information.

3. The “Purchase”: The seller “buys” their own product using this fake account, sending it to your physical address.

4. The Review: Once the tracking information shows the item has been delivered, the seller writes a glowing, five-star review for the product using the fake account. Because the platform sees it as a “verified purchase” delivered to a real address, the system counts it as legitimate.

While the item itself might be cheap—sometimes just a packet of seeds, a cheap plastic accessory, or a hollow box—the danger lies in the fact that someone has your personal data.

Immediate Steps: What to Do When the Mystery Package Arrives

If you receive an item you did not order, do not panic. However, do not simply throw it away without taking precautions. Follow these steps to ensure your security.

1. Do Not Open the Package (If Possible)

If you haven’t opened it yet, don’t. While most brushing packages are harmless physical items, there is a remote risk of contaminated or dangerous goods. If the package is already open, proceed with caution.

2. Inspect the Shipping Label

Examine the return address. Often, these packages come from major e-commerce fulfillment centers. If there is a return address that lists an unknown company, search for that company online. You will likely find forums where other victims are reporting the same thing.

3. Document the Evidence

Take photos of the package, the shipping label, and the item inside. These might be useful if you need to file a report with consumer protection agencies or your local law enforcement later. Keep the original packaging if it contains a return address or a packing slip.

4. Check Your Recent Orders and Accounts

Log into your major e-commerce accounts (like Amazon, eBay, or Walmart). Check your “Order History” to ensure no one has compromised your account to make unauthorized purchases. If you see items you didn’t order, change your passwords immediately and enable Two-Factor Authentication (2FA).

Are You Legally Obligated to Pay for or Return the Item?

Many people worry that they will be held responsible for the cost of an unsolicited package. In the United States, the Federal Trade Commission (FTC) has very clear rules regarding this.

You are not legally obligated to pay for or return unordered merchandise. Under the FTC’s regulations, unordered merchandise is considered a gift. You are allowed to keep it, donate it, or discard it as you see fit. You do not have to notify the sender, and they cannot legally demand payment for the item.

However, just because you can keep the item doesn’t mean you should ignore the implications. The package is a sign that your data has been compromised.

Why You Should Be Concerned About Data Privacy

The biggest risk is not the package itself, but the information that allowed the package to reach your door. If a seller has your name and address, they might have more.

Data Breaches and the Dark Web

Personal information is frequently sold in bulk on the dark web following major corporate data breaches. Once your address is paired with your name, it becomes a target for more than just brushing scams. It can lead to:

• Phishing Attempts: You may receive emails or texts claiming to be from delivery services asking for “delivery fees” or “address verification.”

• Identity Theft: Sophisticated scammers may use your information to open credit lines in your name.

• Targeted Scams: With your address, scammers can create more believable scams that look official because they include your correct personal details.

Strengthening Your Digital Fortification

Once you’ve dealt with the immediate package, it is time to perform a “security audit” of your digital life to prevent further incidents.

Enable Multi-Factor Authentication (MFA)

MFA is your strongest defense against unauthorized account access. Ensure that your email, banking, and shopping accounts require a code sent to your phone or an authenticator app, in addition to your password.

Use Strong, Unique Passwords

If you are reusing passwords across multiple sites, a breach on one site puts all your accounts at risk. Use a Password Manager (like Bitwarden, 1Password, or Dashlane) to generate and store complex, unique passwords for every site you visit.

Monitor Your Credit Reports

Because your address and name have been circulating, it is wise to keep an eye on your credit. You can request a free credit report from the three major bureaus (Equifax, Experian, and TransUnion) at AnnualCreditReport.com. Look for any accounts, loans, or credit inquiries that you did not initiate.

How to Report Unsolicited Packages

If you suspect you are a victim of a brushing scam or have received a suspicious package, you should report it to help authorities track these patterns.

• Report to the Platform: If the package appears to have come from a specific e-commerce site, use their “Report” feature. They have teams dedicated to investigating and shutting down fraudulent seller accounts.

• Contact the FTC: You can report the incident at ReportFraud.ftc.gov. The FTC uses these reports to build cases against fraudulent companies.

• Contact the Shipping Carrier: While carriers like UPS, FedEx, or USPS have limited power to stop these shipments, reporting the incident can sometimes help them flag fraudulent accounts that use their services for high-volume, suspicious deliveries.

Identifying Other Types of Package Scams

Not every unsolicited package is a simple brushing scam. Here are other types of scams you should be aware of:

1. The “Delivery Fee” Scam

You receive a notification via text or email that a package is waiting for you, but you need to pay a small “shipping fee” to release it. This is a phishing scam. They are trying to steal your credit card information. Never click links in unexpected delivery notifications.

2. The “Advance-Fee” Scam

You receive a package containing an item you didn’t buy, followed by a call or email claiming you “won” a sweepstakes or prize, but you must pay a “tax” or “processing fee” to receive the rest of your prize. This is a classic advance-fee fraud.

3. Return Scams

Sometimes, scammers will send a package to your address, but they don’t actually want you to have it. They monitor the delivery status, and as soon as it arrives, they show up to claim it—or they use it to “verify” an address for other illicit activities.

Best Practices for Secure Online Shopping

To reduce the likelihood of your data ending up on a scammer’s list, adopt these habits:

• Shop on Reputable Sites: Stick to well-known retailers with established security protocols.

• Check the Seller: If shopping on a marketplace, look at the seller’s history. Are their reviews recent? Are they suspiciously uniform?

• Be Skeptical of “Too Good to Be True” Deals: If you see a high-value item listed for an incredibly low price, it is likely a scam designed to harvest your data.

• Limit Shared Information: Only provide the absolute minimum information required for a transaction. Avoid giving your phone number unless it is strictly necessary for delivery.

When to Contact Local Authorities

If you ever receive a package that contains something dangerous, suspicious, or illegal (such as unknown substances, electronics that seem tampered with, or items that look like they could be explosives), do not touch it. Leave the area immediately and contact local law enforcement.

While most brushing scams are benign, you should always trust your gut. If a package makes you feel unsafe, let the professionals handle it.

Staying Vigilant in a Digital World

Receiving an unordered package is a disruption, but it doesn’t have to be a disaster. By understanding that these items are often part of a brushing scam—and by knowing that you are not responsible for them—you can reclaim your peace of mind.

The most important takeaway is that your personal data is a valuable asset. The fact that you received a package means your data was leaked, so treat this as a wake-up call to update your passwords, enable two-factor authentication, and keep a closer eye on your financial statements.

Stay safe, stay vigilant, and remember that when it comes to your doorstep, silence and caution are often your best tools.

Frequently Asked Questions (FAQ)

Q: Can I keep the item?

A: Yes. Under FTC rules, unordered merchandise is considered a gift, and you are not required to pay for it or return it.

Q: Should I open the box?

A: It is generally safer not to open it. If you do, do not eat any food items or use any products that appear to be cosmetics or chemicals.

Q: Does this mean my bank account is hacked?

A: Not necessarily. Usually, these scams use your name and address, not your banking details. However, it is always a good idea to check your recent statements for unauthorized charges as a precaution.

Q: Why do they send me cheap things like seeds?

A: Scammers use cheap, lightweight items to keep shipping costs low while still creating a “verified” transaction in the eyes of the e-commerce platform’s algorithm.

Q: Should I contact the seller?

A: No. Contacting the sender confirms that your address is “active” and that you are a real person who monitors your mail. This could lead to more spam or targeted scam attempts. It is better to ignore the package and report the incident to the platform or the FTC.