Got a Package You Never Ordered? The FTC Says It Could Be a Sign Someone Has Your Information

September 4, 2026

An unexpected package usually brings one of two reactions: excitement that something fun arrived or confusion over why anyone sent a box of baby wipes, toothpaste, or random seeds. But the Federal Trade Commission now has a less cheerful explanation for those mystery deliveries: someone may have your personal information. The FTC warns that an unsolicited package can signal a “brushing” scam, in which a seller uses someone’s name and address to make fake purchases and reviews look legitimate.

A strange box deserves more attention than a shrug and a trip to the junk drawer, especially if the package includes a QR code, asks for a review, or seems connected to an account that nobody in the household recognizes.

The Mystery Box May Be Part of a Fake Review Scheme

The FTC calls this type of operation a brushing scam because scammers use fake orders and reviews to make their products or businesses appear more popular than they really are. A seller can send an inexpensive item to a real address, then use the recipient’s name to create the appearance of a genuine purchase. That fake purchase can support a glowing review that makes the seller look more trustworthy to future shoppers.

The recipient may never realize anything happened beyond the arrival of a bizarre little package. That makes the scheme particularly sneaky because the merchandise itself may have little value to the person who receives it. The bigger clue involves the information behind the delivery, because the scammer needed enough personal details to connect the shipment with a real person and address.

An Unordered Package Does Not Automatically Mean Identity Theft

Finding an unexpected box does not prove that someone has stolen a Social Security number, taken over a bank account, or committed financial identity theft. The FTC specifically warns that an unsolicited package could mean someone has your personal information or wants to obtain more of it, which makes the delivery a warning sign rather than a diagnosis.

That distinction matters because panic can push people toward exactly the wrong response. A person might search for the sender, call a number printed on a note, or scan a QR code simply to solve the mystery, handing a scammer another opportunity in the process. The smarter move involves treating the package as suspicious while checking the accounts and credit information that could reveal whether someone has gone beyond the package itself.

That QR Code Could Be the Real Trap

Some unexpected packages include a note with a QR code that promises to explain who sent the item or help arrange a return. It sounds convenient, especially when the box contains something completely unfamiliar, but the FTC warns that scanning the code could lead to a phishing website designed to steal usernames, passwords, or payment card information.

That turns a strange delivery into a potential two-step scam. First, the unexpected package gets attention, then curiosity does the rest of the work when the recipient scans the code. There is no good reason to hand over login credentials or financial information just because a mystery box arrived, so leave the QR code alone and use the shopping platform’s legitimate website or app if an investigation makes sense.

Check Shopping Accounts and Credit Reports

The FTC recommends changing passwords on online shopping accounts after receiving an unordered package, particularly if the shipment appears connected to a marketplace such as Amazon. If the package came through an online marketplace, contact the platform through its legitimate customer-service channel so it can investigate the seller and potentially remove fake reviews.

Credit monitoring also deserves a place on the checklist. The FTC recommends checking credit reports weekly for free through AnnualCreditReport.com and watching for accounts or activity that do not belong to you. If an unfamiliar credit account appears, that changes the situation from “weird package” to a much more serious identity-theft concern.

Do Not Call the Sender or Pay for the Package

A mystery package can create a powerful urge to solve the mystery immediately, but contacting the sender can give a scammer exactly what they want: another conversation with a real person. The FTC previously warned consumers not to contact unknown senders because the person who responds may try to extract additional sensitive information.

There is also no need to panic about a bill arriving later. Federal law generally protects consumers from companies that send unordered merchandise and demand payment, and consumers do not have to return unordered merchandise or pay for it. Still, caution makes sense before using an unfamiliar product because nobody knows whether the item itself poses a safety concern or came from a legitimate seller.

A Strange Delivery Can Be a Useful Warning

The most important part of the FTC warning involves what happens after the package hits the doorstep. Check shopping accounts, review credit reports, change compromised passwords, and turn on two-factor authentication where available, particularly if the package connects with suspicious account activity.

If something more serious turns up, such as an unfamiliar account or evidence that someone used personal information, report identity theft through IdentityTheft.gov and report scams to the FTC at ReportFraud.ftc.gov. A random package may turn out to be nothing more than a scammer trying to manufacture a fake five-star review, but it can also serve as an early warning that personal information has started circulating where it should not. That makes the mystery box worth investigating, even if the mystery turns out to involve nothing more dramatic than a stranger trying to sell toothpaste with a suspiciously enthusiastic review.

The Box Is Not the Problem, It Is the Clue

An unordered delivery does not automatically mean someone has stolen your identity, but it gives consumers a reason to check what is happening behind the scenes. The FTC’s latest warning makes clear that brushing scams can involve someone using your name and address to create fake purchases and reviews, while some packages may also try to lure recipients into phishing scams through QR codes.

The safest response requires surprisingly little detective work: do not scan strange codes, do not contact unknown senders, secure shopping accounts, and check credit reports for anything unfamiliar. If the package connects to suspicious account activity or identity theft, take the next steps quickly instead of hoping the problem disappears on its own. A box you never ordered may contain nothing valuable at all, but the information attached to that delivery could be the thing worth protecting.

Could an unexpected package make you check your shopping accounts and credit report, or would you simply assume someone sent a very strange gift?