If you ever get a mysterious package and can’t figure out why, it’s possible you’re a victim of a brushing scam.

A scammer got your name and address, sent you a real package, and will use that information to file a 5-star review somewhere. Sometimes, the package will include a QR code that, if you scan and visit, will try to get you to install malware or enter in personal details “to find out more.”

Brushing scams have evolved over the years. They used to do it for reviews, now they have broadened it to include trying stolen credit cards, delivering QR codes, test stolen accounts, etc.

Here’s what you should do in response:

Discard or Donate the Item

If you don’t want the item, you can discard or donate it. Federal law says that unsolicited merchandise is generally considered a gift. You don’t have to pay for it and you don’t have to return it.

If you want to keep it, you can. If you don’t, it’s yours to do as you wish.

Never Scan a QR Code

You may be tempted to “find out” who sent this to you… but don’t ever scan a QR code. That will almost always send you to a site that will try to convince you to download malware or enter in your personal information. You will not find out more, you will only tell them more.

Report to Authorities

If you can find out what marketplace “sold” you the item, try to reach out and report it to them. Amazon has a brushing report page as does Wal-mart.

You can also report it to the carrier that delivered it:

If a QR code is involved, you will want to report it to the Internet Crime Complaint Center.

If the package came from Amazon or Wal-mart or Temu or whatever, check those accounts. Log in directly (don’t scan a QR code!) and look for any orders you didn’t place, new payment methods or shipping address, and any hidden or archived orders.

If you see anything weird, change your password and turn on two factor authentication.

Review Your Credit

Your name and address were probably obtained from a data breach, public records, or a data broker. Since mailing addresses are widely available, receiving a brushing package doesn’t necessarily mean criminals have your Social Security number or financial accounts. It does mean your information is circulating, so it’s worth being extra cautious.

It’s important to review your credit reports to see if there’s any strange activity. While you’re at it, keep an eye on your credit card statements too (or turn on transaction notifications to see if there are any small test charges).

Finally, start taking some of these steps to protect your identity (like freezing your credit!) and delete your data from data brokers.

Not Every Unexpected Package is a Scam

Sometimes you really did get a gift… so it’s important not to overreact. Sometimes a merchant will accidentally send multiple items or it’s a replacement you forgot was coming.

And ultimately, most brushing scams don’t directly steal money. Their goal is usually fake reviews, confirming your address, or getting you to interact with a malicious QR code or website.

As long as you don’t scan anything, enter personal information, or send money, you’re unlikely to suffer any immediate harm. Use it as a reminder to review your online accounts and tighten your identity protection.