Here's a strange one that's been catching people off guard: a package shows up at your door that nobody in your house ordered. Maybe it's a cheap phone case, a handful of seeds, a random gadget. There's no note, no explanation. Your first thought is usually, "Well — free stuff?"

I'd gently pump the brakes on that.

What you're most likely seeing is called a brushing scam, and while the package itself is harmless, what it signals is worth paying attention to.

Here's how it works. Shady online sellers want more five-star reviews to climb the rankings on big shopping sites. So they create fake buyer accounts and ship cheap items to real names and addresses — often ones pulled from a data leak. Once a package is "delivered," they post a glowing review under your name as a so-called verified purchase. You never bought anything, but on paper it looks like you did, and you loved it.

So why should you care, if the stuff is free? Because for the seller to pull this off, they needed your name and address — and sometimes more. Getting a brushing package is a quiet signal that your information is floating around somewhere it shouldn't be. It's a bit like finding a stranger's footprints in your yard: the footprints themselves don't hurt you, but you'd want to know how they got there.

If it happens to you, here's what I'd actually do:

  1. Don't scan any QR code or call any number printed on the package or a note inside it. That's the one way a harmless package turns genuinely dangerous — some brushing packages now include a QR code "to see who sent it," and it leads somewhere you don't want to go.
  2. Keep the free item if you like — you're legally allowed to keep unordered merchandise, and returning it is more hassle than it's worth.
  3. Change the password on the account tied to that address — usually your main shopping account — and turn on two-factor authentication if you haven't. If your info is out there, you want the actual accounts locked down.
  4. Check whether your details have leaked. There are free, reputable tools that tell you if your email has shown up in a known data breach. This is exactly the kind of thing I'll walk people through in a future post — or in a one-on-one session if you'd rather have someone do it with you.

A mystery package is a small thing. But it's the kind of small thing that's worth reading correctly — because it's often the first quiet hint that something bigger deserves a look.

Stay sharp out there. Andrew