Multiple Faces Detected
February 28th, 2026
A package shows up at your front door. You did not order it. There is no return address, no gift note, just a cheap item sealed in plain packaging with your name and address on it. You think maybe someone sent it as a surprise. You keep it, and then forget about it.
That moment of innocent curiosity is exactly what brushing scammers are counting on.
Brushing scams happen when scammers find your address or other personal information online, send you goods you never ordered, and then use your information to write fake online reviews about their products in your name, which helps them boost sales. In 2026, the scam has evolved into something far more dangerous than a free trinket on your porch, and the FTC, FBI, and U.S. Postal Inspection Service are all sounding the alarm.
Before you open your next mystery package, run a quick search on Social Catfish to find out what personal information scammers may already have on you. The more exposed your data is, the more likely you are to become a target.
What Is a Brushing Scam?
A brushing scam is a fraud tactic where sellers send unsolicited packages to real people in order to post fake “verified” reviews. The goal is to trick e-commerce platforms and future customers into thinking a product is more popular or trustworthy than it really is.
How the Scheme Works Step by Step
- A scammer obtains your name and address through a data broker, people search site, or dark web data dump
- They create a fake buyer account on Amazon, AliExpress, or eBay using your identity
- They purchase their own cheap product through that fake account and ship it to your address
- When the package is marked as delivered, the platform registers a verified sale
- The scammer posts a glowing five-star review under your name
- They repeat this process thousands of times across thousands of real addresses
What Items Usually Arrive
- Cheap jewelry, rings, or hair accessories
- Phone chargers, adapters, or wireless earbuds
- Household gadgets or kitchen tools
- Beauty products or cosmetics
- Seeds, pet toys, or random plastic trinkets
The items are almost always lightweight and low-cost. The expense of shipping is a small price to pay for what can be thousands of fake verified reviews pushing a product to the top of search rankings.
The 2026 Upgrade: QR Codes Are Now Weaponizing These Packages
The original brushing scam was mostly a nuisance. You got free junk, a scammer got fake reviews, and most people never realized they had been used. But in 2025 and carrying into 2026, the scam mutated into something with real teeth.
In a variation now actively tracked by the FBI, scam actors have incorporated QR codes on packages to facilitate financial fraud activities. The package arrives just like before, unsolicited, cheap, no return address, but now there is a card or sticker inside that says something like:
- “Scan to find out who sent you this gift”
- “Scan here to return this item”
- “Scan for a special reward from the sender”
It sounds completely reasonable. Who would not want to know who sent them something? That curiosity is the trap.
What Happens When You Scan
If you scan the QR code, it could take you to a phishing website that steals your personal information, like credit card numbers or usernames and passwords. It could also download malware onto your phone and give hackers access to your device.
Security experts call this hybrid attack “quishing,” a combination of QR codes and phishing. These fake websites look legitimate and appear to be official sites of banks, government organizations, or other institutions. But they are actually scam sites used by criminals to get your personal identifiable information.
Where the QR Code Might Be Hidden
- Printed on a card inside the box
- A sticker on the outside of the package
- Affixed directly to the product
- Embedded in what looks like a gift receipt or thank-you note
The scammer plays on recipients’ curiosity about the mystery sender; they did not order the package and cannot imagine someone sent it as a gift, so scanning the code feels like the only way to get an answer. That one scan can expose your login credentials, banking information, and passwords, or silently install malware that gives hackers ongoing access to everything on your device.
How Scammers Got Your Name and Address
One of the most unsettling parts of a brushing package is realizing someone already knows where you live. Scammers can obtain your information in a few ways: from data brokers, public records, information you post online, or through information leaked in data breaches and sold on dark web websites.
The Most Common Sources
- People search sites — websites that compile your name, address, phone number, relatives, and employment history and make them searchable to anyone willing to pay a few dollars. There are hundreds operating in the United States.
- Data brokers — companies that buy and sell personal data in bulk, often scraped from public records, social media, and loyalty programs
- Data breaches — if your information was exposed in a past breach, it may have been sold on the dark web and added to scammer mailing lists
- Social media and public posts — addresses posted publicly on Facebook Marketplace, real estate listings, business directories, or anywhere online
- The electoral roll — in some cases, voter registration records are used to source addresses
You do not need to have ordered anything for your name to land on one of these lists. Simply having a public digital footprint is enough.
This is where Social Catfish becomes a critical tool. Running a search on your own name, phone number, or email shows you exactly what is publicly visible and accessible to scammers right now, so you can take steps to reduce your exposure before you end up on another list.
Why This Is Not Just a Nuisance
Most people who receive a mystery package shrug it off. Free stuff, no harm done. But the real problem is not the item in the box, it is what the delivery tells you about your data.
What a Brushing Package Actually Signals
- Someone has your name and physical address
- That information came from somewhere a breach, a broker, or a public record
- The same data could be in the hands of multiple bad actors, not just the brushing scammer
- Your name may already be attached to fake reviews or fake buyer accounts on marketplace platforms without your knowledge
Doing online shopping in your name might only be the beginning. Scammers may be able to set up fake accounts using your personal information and gain access to your Amazon and other online accounts, or even your bank accounts.
Additional Risks You May Not Have Considered
- Fake reviews under your name can cause your account to be flagged or suspended during a platform fraud investigation — even though you did nothing wrong
- Counterfeit or unsafe products — cosmetics, supplements, seeds, and cheap electronics in brushing packages may be expired, banned, or dangerous. Do not use them.
- Porch theft — in some cases, scammers ship to your address and then steal the package before you retrieve it, using the delivery as cover
- Being targeted again — if a brushing scam succeeds, scammers are more likely to try it again, which could lead to a stream of packages showing up at your door.
Red Flags That a Package Is Part of a Brushing Scam
Signs to Watch For
- No return address, or the return address belongs to a major retailer you never ordered from
- The item inside is cheap, random, and completely unrelated to anything you would purchase
- There is a QR code anywhere on or inside the package with instructions to scan it
- The packaging is vague with no specific company name or branding
- No invoice, no gift receipt, and no explanation for why it was sent
- Multiple unexpected packages have arrived within a short period of time
A QR code combined with any of the other signs above is a definitive signal put the package down and report it without scanning anything.
What to Do If You Receive a Brushing Package
Do Not Scan Anything
Do not scan any QR code, click any link, or follow any instructions included in or on the package. The curiosity is understandable, but a single scan can be enough to compromise your device and your accounts.
Keep, Donate, or Discard the Item
Under U.S. federal law, you have no obligation to pay for or return unsolicited merchandise. You can keep it, donate it, or throw it away. Do not use cosmetics, supplements, seeds, or food items from an unknown sender; they may be counterfeit, expired, or unsafe.
Report the Package
- The marketplace (Amazon, eBay, etc.) — report the package and request removal of any fake reviews posted in your name
- U.S. Postal Inspection Service — email [email protected] or visit uspis.gov
- FBI Internet Crime Complaint Center — file a report at ic3.gov
- FTC — report at ReportFraud.ftc.gov
Secure Your Accounts
- Change passwords on all shopping, email, and financial accounts
- Use strong, unique passwords for each account
- Enable two-factor authentication wherever available
- If you already scanned a QR code, run a full security scan on your device immediately
Check Your Credit
- Pull your free credit report at AnnualCreditReport.com
- Look for accounts you do not recognize, unfamiliar addresses, or credit inquiries you did not initiate
- If anything looks wrong, freeze your credit at all three bureaus Equifax, Experian, and TransUnion immediately
Search Your Own Information on Social Catfish
Run a search on your name, phone number, email, and address through Social Catfish to see what is publicly accessible right now. Knowing what scammers can already find gives you a clear picture of what needs to be cleaned up and helps you get ahead of the next attack before it reaches your door.
How Social Catfish Helps You Stay Ahead of Brushing Scams
The most effective defense against brushing scams is not reactive; it is knowing your exposure before a scammer does.
What You Can Do With Social Catfish
- Name search — find every platform and database where your name appears publicly
- Phone number lookup — see what accounts and profiles are tied to your number
- Email search — check what identity information is linked to your email address
- Address lookup — see which records publicly connect your home address to your identity
- Reverse image search — if you received a package claiming to be from a specific person or business, search their photo to verify whether the identity is real
If you suspect a brushing scammer has been posting fake reviews under your name, you can also use Social Catfish to investigate the name or business on the package. Scammers operating at scale often leave digital traces across platforms, and surfacing those connections gives you documented evidence for your reports to the FTC and FBI.
Frequently Asked Questions About Brushing Scams
Receiving the package itself is low risk, but it is a clear signal that your personal information is exposed and circulating. The greater danger comes from the QR codes now included in many packages, which can lead to phishing sites or malware with a single scan. Treat any unexpected package as a warning that your data is out there and take immediate steps to find out how much.
No. Under U.S. federal law, you are not required to return or pay for unsolicited merchandise. You can keep it, donate it, or discard it. Avoid using any cosmetics, food items, supplements, or electronics from an unknown sender, as they may be counterfeit, expired, or unsafe.
Most likely from a people search site or data broker platforms that compile and sell available personal information publicly. Your address may also have been exposed in a data breach and sold on the dark web. Running a search on Social Catfish shows you what is currently accessible, so you know exactly what you are dealing with.
No. Never scan a QR code from an unexpected package. The codes are framed as a helpful way to identify the sender or initiate a return, but they lead to phishing websites or trigger malware downloads. If you have already scanned one, change your passwords immediately, run a full security scan on your device, and monitor all accounts closely for unusual activity.
Yes. If a scammer posts fake reviews under your name, your account can get flagged during a platform fraud investigation even though you did nothing wrong. Report the unsolicited package to Amazon immediately, request removal of any reviews in your name, and update your account password and security settings right away.
The Bottom Line
Brushing scams have always been more serious than they look. A free package at your door is not a gift, it is evidence that someone already has your personal information and is using it. In 2026, with QR codes turning mystery deliveries into phishing traps, the stakes are higher than ever.
The best move you can make right now is to find out what scammers can already see. Run a search on Social Catfish using your name, phone number, email, or address. See what is out there. Then take steps to reduce it because the less accessible your information is, the harder you are to target.
Worried your personal information is already out there? Run a free reverse search on Social Catfish search by name, phone, email, or address to see what scammers can find. 100% confidential. Results in minutes
