A Mystery Package You Never Ordered: The Brushing Scam Explained
A small parcel arrives with your name on it, and you did not order it. Inside is a cheap gadget, a ring, a packet of seeds, and no invoice. It is not a gift and it is not a lucky mistake; it is almost certainly a brushing scam, and the parcel is the least important part. Here is what is going on, what you may keep, and the four things you should do before you throw the box away.
What "Brushing" Is
Marketplaces rank sellers partly on sales and verified reviews. A seller who wants to climb that ranking can buy their own products through fake accounts, ship them to real addresses so the marketplace records a genuine delivery, and then post glowing reviews under the buyer's name. The item has to go somewhere, so it goes to you. The United States Postal Inspection Service describes exactly this pattern and calls it brushing, and it is the reason the contents are always cheap and light: the seller is paying postage for a review, not sending you a present.
That tells you what the scam is not. It is not usually an attempt to charge you; no payment was taken from you and none will be. The problem is that a seller you have never dealt with has your name and address, and sometimes more, and is using them. What you should worry about is where that information came from.
What You Should Do
- You may keep unordered merchandise; federal law says you owe nothing for goods you did not ask for, and you should not pay anyone who contacts you about it.
- Do not scan any QR code on the parcel or its contents, and do not plug in any USB device it contains.
- Change the password on your marketplace accounts, check for orders and reviews you did not make, and report the parcel to the Postal Inspection Service.
- Keep it or bin it; do not pay. The Federal Trade Commission is plain: if you receive merchandise you did not order, you have a legal right to keep it as a free gift. You are under no obligation to return it or pay for it. Anyone who contacts you asking for payment is running a second scam on top of the first.
- Do not scan the QR code. Many brushing parcels carry a code inviting you to "find out who sent this" or "claim your gift". Scanning it takes you to a page that asks for account details or installs something. The Postal Inspection Service's advice is not to scan it, and neither should you.
- Do not plug in anything with a USB plug. If the item is a flash drive or a "gadget" with a data connector, treat it as untrusted hardware. The reasons, and what a storage device from an unknown source can do to a computer, are in is it safe to plug in a USB gadget from a mystery box.
- Check and secure your accounts. Log in to the marketplaces you use, look at your order history for orders you did not place and your profile for reviews you did not write, and change your password. If the parcel came through a marketplace, tell that marketplace; they have a process for brushing reports and can remove the fake review.
- Report it. The Postal Inspection Service takes reports at uspis.gov/report, and the FTC at ReportFraud.ftc.gov. A report costs you five minutes and is how patterns get noticed.
If you would rather not keep the item, you can refuse the parcel unopened by marking it "return to sender" and handing it back to the carrier, which costs you nothing. Once it is open, disposing of it is the simpler answer.
Brushing Parcel or Something Else?
| What you see | Most likely | What you do |
|---|---|---|
| Cheap item, no invoice, you ordered nothing | Brushing | Keep or bin; secure accounts; report |
| Same, with a QR code to "claim" or "identify sender" | Brushing plus phishing | Do not scan; report |
| Item you did not order, from a retailer you use, invoice inside | Wrong address or a gift order | Contact the retailer with the order number |
| Parcel addressed to a former resident | Mis-delivery | Mark "not at this address"; return to carrier |
| Parcel you did not order, followed by a demand for payment | Unordered merchandise scam | Do not pay; report to the FTC |
| A mystery box you did order, arriving without the invoice inside | Normal for many sellers | Match the tracking number to your order email |
Read the last row carefully if you buy mystery boxes, because the two things can look alike on the doormat. A box you ordered has three things a brushing parcel never has: an order confirmation in your email, a tracking number that matches it, and a seller you can name. If you cannot find those, you did not order it. If you can, it is your box, and the first-hour routine in what to do when your mystery box arrives applies.
Note: A brushing parcel means your name and address are in a dataset somewhere, which is unpleasant but not, on its own, a sign that your accounts are breached. The check that matters is whether an account you hold shows activity you did not create. If it does, change that password, turn on two-factor authentication, and treat any recent unusual email as suspect. If it does not, the address was probably bought from a list, and there is little more to do than report.
Why It Matters for Mystery Box Buyers in Particular
Brushing parcels have given the phrase "mystery package" a bad name, and people who buy mystery boxes on purpose sometimes get lumped in with people who received one by fraud. The difference is the transaction. A legitimate mystery box is a product you chose, paid for through a method with a dispute right, and can trace from a seller's page to your door. A brushing parcel is an unpaid, unrequested, untraceable delivery. The wider question of which sellers are legitimate is answered in are mystery boxes legit; the short version is that a real seller has pages, policies and tracking, and a brushing operation has a label.
It also helps to know that legitimate sellers dislike brushing as much as you do, because it corrupts the reviews you use to judge them. A seller with a review page full of five-star, one-line, undated comments is showing you what brushed reviews look like. A seller with dated reviews that mention specific items and specific problems is showing you the real thing; the full reading method is in how to read mystery box reviews after the FTC fake review rule.
What This Means When You Order
You protect yourself from confusion by keeping your own paper trail tidy: an order email for every box, a tracking number you can match to it, and a seller whose name is on both. When a parcel arrives that matches none of those, you know at once what it is. Mewoo sends an order confirmation and a tracking number for every box and states its policies on its own pages; hold any seller to that. A parcel with no trail behind it is not a mystery box. It is someone else's review, and you can bin it.
FAQ
I got a package I did not order. Do I have to send it back?
No. Federal consumer law treats unrequested merchandise as yours to keep, use, or discard, with nothing owed to anyone. Returning it is optional and only worth doing if you refuse the parcel unopened, since the carrier then takes it back at no cost. Once it is open, there is nobody worth posting it to. Whatever you decide, never pay a fee or "shipping charge" that someone later requests.
Does a brushing parcel mean my account was hacked?
Rarely. Address lists circulate widely, and a name plus a street is enough for the sender's purpose. Still, spend five minutes on each shopping site you use: open the order history and the reviews attached to your profile. Clean history, no action needed beyond the report. Strange orders or reviews you never wrote, reset the password there immediately and enable two-step sign-in before doing anything else.
Should I scan the QR code to find out who sent it?
No. Postal inspectors specifically warn against it, because the code on a brushing parcel typically leads to a page designed to harvest a login or push a download, and "discover your sender" is the bait. Curiosity about the sender is exactly what the scam counts on. Photograph the label if you want a record for your report, and leave the code alone.
Where do I report an unsolicited package?
Start with the postal inspectors, whose online form is at uspis.gov, then file a second note with the FTC through its fraud reporting site. Each takes a few minutes and neither requires the parcel itself, just the label details and a description of the contents. Where the packaging names a marketplace, contact that platform as well so the phoney review under your name can be pulled. Expect no refund, since you never paid.
How can I tell a brushing parcel from a mystery box I bought?
Search your inbox for the tracking number printed on the label. A purchase leaves a confirmation email with that same number in it and a shop name you recognise; a brushing delivery leaves nothing to find. Sellers often leave the invoice out of a box you bought, so a missing slip proves little either way. The email is the evidence. No email, no purchase, whatever the contents look like.
Is the item in a brushing parcel safe to use?
Usually harmless and usually worthless: a plastic ring, a phone stand, a packet of seeds. Two exceptions deserve caution. Anything with a USB plug should stay out of your computer, and seeds should not be planted, since agricultural authorities asked people not to sow unsolicited seeds during the 2020 wave of these parcels. Everything else can be used, given away or thrown out as you see fit.
Final Thoughts
A parcel you never ordered is a seller buying a review with your address. Keep the item or bin it, pay nobody, scan nothing, and plug in nothing. Check your marketplace accounts for activity that is not yours, change the password if you find any, and report the parcel to the postal inspectors. A real mystery box has an order email, a matching tracking number and a seller you can name; a brushing parcel has a label and nothing else.
If you want a box with an order confirmation, a tracking number and stated policies behind it, start with the Discovery Electronics Mystery Box (1 item) or the Triple Reveal Electronics Mystery Box (3 items). Compare every tier side by side on the electronics mystery box category page.
See the pages a real seller should have →
