Inside the padded envelope left on the doorstep, correctly addressed and carrying the right name on the label, is a tube of toothpaste nobody ordered. The obvious question is who sent it. The more useful question, according to a Federal Trade Commission consumer alert published on August 20, is what the sender got in return, because the object in the box is not the thing that had value in the transaction.
Why the item inside is cheap and random on purpose
The alert describes an arrival that looks legitimate at a glance. It typically appears to come from a known company such as Amazon, or from a person or business the recipient has never heard of, and it is addressed correctly. Recent reports to the commission say the contents are usually something cheap and random: baby wipes, toothpaste, or seeds.
The reason for the low value is structural. “Scammers do this so they have ‘validation’ of delivery,” the alert states. “Then they use your name to place fake reviews online about their business to ‘brush up’ their sales.” The seller is buying a delivery confirmation attached to a real name at a real address, and the cheapest possible object is simply the cheapest way to generate one.
That is what makes the practice worth the postage. The package is a cost; the validated delivery is the product. The recipient’s name is the asset being spent, and by the commission’s description it is spent on reviews the recipient never wrote, for a business the recipient has never dealt with, without any notice that either thing happened.
Free retirement updates: Keep more of your Social Security and savings with plain-English updates on the changes, deadlines, and costly mistakes retirees miss. Subscribe free.
The QR code that sometimes comes in the box
The newest and most concrete hazard in the alert is a piece of paper rather than the product. As the commission puts it: “Sometimes, the sender might leave a note with a QR code inside the package. It might say to scan to find out who sent the package, or to process a return. But scanning could take you to a phishing website designed to steal information like your credit card numbers, usernames, or passwords.”
The design of that note is worth noticing, because it answers the exact question the package creates. A recipient holding an unexplained box wants to know who sent it, and the code offers to say. A recipient who wants the item gone wants to send it back, and the code offers to arrange it. Both invitations point at the same destination.
A printed code gives away nothing about where it leads, which is the whole reason it works better than a link in an email. The credentials named in the alert are ordinary ones, card numbers, usernames, and passwords, and a shopping password reused elsewhere is worth considerably more than the toothpaste that carried the note through the front door.
The second possibility the FTC raises about the data
The alert is careful about how far it goes on this point, and the hedge should be kept intact. An unexpected package “could be a brushing scam,” it says, and it “could also be a sign that someone has (or is looking to steal) your personal information.” Those are possibilities rather than conclusions. The fake review is the primary explanation; the information angle is a secondary one that the commission raises without asserting.
The steps it recommends follow that framing. Passwords on online shopping accounts should be changed in case those accounts were compromised, and if the package came from Amazon or another online marketplace, the alert advises messaging the platform so it can investigate removing the seller. That second step is the only one that reaches the seller rather than the symptom.
On monitoring, the alert names a specific and free option: check credit weekly at no cost through AnnualCreditReport.com, watching the information in the report for signs of identity theft. It stops there. The alert does not recommend a credit freeze, and a reader following it is being told to look at the report regularly rather than to lock anything down. The free weekly access runs through the official site, which is the one the commission points to.
What the law says about goods nobody ordered
On the package itself, the rule is settled and favorable. The alert states that the law does not require anyone to return things they did not order, and that no payment is owed for them either. Anyone who calls demanding payment for an unordered delivery is describing an obligation that does not exist. The commission maintains fuller guidance on unordered merchandise and on being billed for goods never received.
There is one qualification, and the alert supplies it in the same breath: caution about using the product is warranted, because the sender is unknown. Something shipped by an unidentified party for the purpose of generating a delivery record is not a free sample from a company that stands behind it, and consumable items in that category deserve the skepticism that description implies.
The commission’s instruction on reporting is one line: “If you spot a brushing scam, tell the FTC at ReportFraud.ftc.gov.” That matters more than it appears to, since the alert’s own description of what is turning up in these boxes, the wipes, the toothpaste, the seeds, comes from recent reports filed at that address by people who found one on the doorstep and said so.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
