That Package You Didn’t Order Isn’t a Gift. It’s a Receipt.

Unordered boxes are arriving with QR codes inside. Federal law says the stuff is yours to keep. Here’s why the box matters anyway — and the $0 fix it should trigger.

Baby wipes. Toothpaste. A packet of seeds. That’s the kind of thing people are finding in packages they never ordered, according to an FTC consumer alert published August 20, 2026. The box has your name on it. It has your address on it. And sometimes there’s a small card inside with a QR code and a friendly line — scan to see who sent this, or scan to process your return.

Leave the code alone. Keep the toothpaste.

What’s actually going on

The original version of this is called a brushing scam, and it’s about fake reviews, not your money. A seller ships something cheap to a real name and address they found online, uses the delivery as proof of a purchase, and then posts a glowing review under your name to “brush up” their ratings (FTC, August 20, 2026). Irritating. Not expensive.

The newer version is a different animal. The FBI’s Internet Crime Complaint Center issued a public service announcement (Alert I-073125-PSA, July 31, 2025) about criminals shipping unsolicited packages containing QR codes — often deliberately without sender information, so that curiosity does the work of getting you to scan. The FBI warns the code can lead to a request for personal and financial information, or to a download that quietly pulls data off your phone.

The FTC’s August 2026 alert describes the same setup in plainer words: scanning “could take you to a phishing website designed to steal information like your credit card numbers, usernames, or passwords.”

What this means for your wallet

Here’s the part that usually goes unsaid. The package isn’t the attack. The package is a receipt — evidence that your name and mailing address are already sitting in somebody’s list.

That’s worth more attention at our age than most. The FTC’s annual report to Congress, released December 1, 2025, found that Americans 60 and over reported $2.4 billion in fraud losses in 2024 — about four times the roughly $600 million reported in 2020. For people 80 and over, the median reported loss was more than $1,600. Not an average inflated by a few catastrophes. The middle of the pack.

So the useful question isn’t “who sent me seeds.” It’s “what else is my information attached to?” Answering that costs nothing:

• Pull your credit reports. All three bureaus are free every week at AnnualCreditReport.com (FTC, August 20, 2026). You’re looking for one thing: an account you don’t recognize.
• Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion. A freeze is free for anyone, for any reason, under federal law, and it stays until you lift it (FTC, “Credit Freezes and Fraud Alerts”). It blocks a new account from being opened in your name, and you can thaw it yourself whenever you want to apply for something.
• Change your shopping-account passwords and tell the marketplace. If it came through Amazon, they run a Report Unwanted Package form for exactly this (Amazon Customer Service).

Three websites, one afternoon, no fee. That’s the whole defense.

The part worth knowing

You do not have to send it back. Under federal law, merchandise you never ordered is yours to keep — no return, no payment (FTC, August 20, 2026). Anyone who calls demanding shipping money for it is not legitimate, and you can hang up without explaining yourself.

Two smaller cautions. Be careful about actually using a product from an unknown sender; you don’t know what’s in it. And if you’re 60 or older and want help filing a report, the Justice Department’s Elder Justice Hotline is 1-833-372-8311 (FBI IC3, July 31, 2025). Reports at ReportFraud.ftc.gov are how these sellers land on anyone’s radar in the first place.

The takeaway

A mystery package is neither a crisis nor a windfall. Treat it as a notification: your details are circulating, and you have a free, permanent way to close the door behind them. Keep the socks. Skip the code. Freeze the credit.

This is information, not financial advice — talk to a licensed professional about your situation.

Senior Savers is independent. We don’t sell your information, and nobody reaches you unless you ask them to — you decide when, and whether, you ever hear from anyone.

Sources

• Federal Trade Commission, “That unexpected package you got could be a brushing scam,” August 20, 2026 — consumer.ftc.gov
• FBI Internet Crime Complaint Center, “Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes,” Alert I-073125-PSA, July 31, 2025 — ic3.gov
• Federal Trade Commission, “FTC Issues Annual Report to Congress on Agency’s Actions to Protect Older Adults,” December 1, 2025 — ftc.gov
• Federal Trade Commission, “Credit Freezes and Fraud Alerts” — consumer.ftc.gov
• Amazon Customer Service, “Report Unsolicited Packages or Brushing Scams” — amazon.com