What Happened
The Federal Trade Commission says recent reports describe a scam that begins with a package nobody ordered. The parcel may appear to come from a familiar marketplace or from a sender the recipient does not recognize. Inside can be something random and inexpensive, such as baby wipes, toothpaste or seeds.
The goal is not generosity. The FTC says scammers use the delivery as “validation” that a package reached a real person, then use the recipient’s name to post fake reviews that make the seller’s products look more popular and legitimate.
Why It Matters
It is a crooked little business model built on turning your front porch into a fake customer testimonial. You did not buy the product, request the product or review the product, but somewhere online you may now appear to be thrilled with it.
The FTC also warns that some packages contain a note with a QR code. The note may say the code will identify the sender or arrange a return. Scanning it can instead take the recipient to a phishing page designed to collect payment information, usernames or passwords.
The Dumb Part With the Toothpaste
Normal advertising tries to persuade you to buy something. Brushing scammers skip that step and manufacture the shopping history first. It is the e-commerce version of putting a “customer of the month” plaque on a stranger’s house.
The cheap item is bait, the fake review is the product, and the QR code is the part where the scam attempts to upgrade from annoying to expensive. Even if the package contains nothing dangerous, the unexplained delivery is a reason to check shopping-account passwords and credit reports rather than follow the sender’s instructions.
What To Do
The FTC says to change passwords on online shopping accounts, contact the marketplace so it can investigate the seller, and check credit reports for signs of identity theft. The law generally does not require you to pay for or return unordered merchandise, though the agency says caution is sensible because you do not know who sent it.
Do not scan a mystery QR code just because it arrived in a box with your name on it. Report suspected fraud at ReportFraud.ftc.gov.
The Bottom Line
If a random package arrives, the best review may be the one you never write. The scammers already have enough fake five-star customers. They do not need your password to complete the set.
Sources
FTC Consumer Alert: That unexpected package you got could be a brushing scam