note:
There are risks in introducing this topic category. It may be used as a how-to guide for aspiring malefactors.
Kiplinger Approved - Sponsored Offer
By Paige Cerulli Edited by Carla Ayers
It’s a scenario that's becoming more common: You arrive home to find a package on your porch. Your name and address are on the package, but you didn’t order it and no one in your household recognizes it.
Don’t assume that it’s simply a shipping mistake — you might be dealing with a brushing scam.
Once the delivery is confirmed, the seller may use your identity to create a fake "verified" review to help artificially boost the product’s reputation, leading to more real sales. According to the USPS, brushing is illegal in the U.S.
To pull off the scam, scammers need genuine names and addresses, which they may get through a data breach or illegal database. That information might include compromised or publicly available data.
If you receive a package in a brushing scam, it may mean that your name and address have been compromised in a data breach. However, that doesn’t automatically mean the scammer has your Social Security number, bank account information or full identity.
If you're concerned that other personal information has been exposed, identity protection services such as Coveron and LifeLock can monitor for signs of compromised information, including data found on the dark web. These services won't prevent a brushing scam, but they can alert you to other potential risks involving your personal information.
The QR code may direct victims to a phishing website designed to capture usernames, passwords, credit card information, birthdates, Social Security numbers, or other sensitive information. According to the FBI, QR codes in unsolicited packages might also lead to malicious software that could steal data from the victim’s phone.
If you receive an unsolicited package, don’t scan any QR codes that it might contain.
Competitors such as Aura, IDShield and McAfee+ also offer identity and credit monitoring, though the specific features, number of credit bureaus monitored, insurance coverage and additional security tools vary by provider and plan. Compare the monitoring features you're most likely to use as well as the price before signing up.
Keep in mind that an identity theft protection service can't prevent someone from sending you a brushing package or guarantee that your information won't be exposed. Its value in this situation is monitoring for additional warning signs and, depending on the service, providing assistance if someone actually uses your information to commit fraud.
Protect more than your identity with Coveron's all-in-one protection
An unexpected package could be a sign that some of your personal information is already in the wrong hands.
Coveron includes identity theft recovery assistance, dark web monitoring, malware breach alerts and coverage for eligible online fraud and cyberattacks.
Kiplinger readers can save 70% on a two-year Identity Theft Protection plan with code KIPCOVERED.
www.kiplinger.com
View Deal
Just because you’re allowed to keep a package you didn’t order doesn’t mean you should use it. You don’t know where it came from or if it’s safe, so it’s best to be cautious regarding anything you’ve received.
Most importantly, a package scam may indicate that your personal information has been compromised online. If you receive a package you didn’t order, then consider tightening up your online protections, checking your account activity and closely monitoring your credit and debit accounts for any unauthorized activity.
There are risks in introducing this topic category. It may be used as a how-to guide for aspiring malefactors.
Kiplinger Approved - Sponsored Offer
Got a Package You Didn't Order? It Could Be a Brushing Scam
An unexpected package may seem harmless, but it could be a sign that scammers have your personal information. Here's how brushing scams work and what to do if a mystery delivery lands on your doorstep.By Paige Cerulli Edited by Carla Ayers
It’s a scenario that's becoming more common: You arrive home to find a package on your porch. Your name and address are on the package, but you didn’t order it and no one in your household recognizes it.
Don’t assume that it’s simply a shipping mistake — you might be dealing with a brushing scam.
What is a brushing scam?
In a brushing scam, a seller sends an inexpensive product to a real person’s address, so delivery is confirmed and the purchase appears legitimate. The seller covers the cost of the product, so you never receive a bill.Once the delivery is confirmed, the seller may use your identity to create a fake "verified" review to help artificially boost the product’s reputation, leading to more real sales. According to the USPS, brushing is illegal in the U.S.
To pull off the scam, scammers need genuine names and addresses, which they may get through a data breach or illegal database. That information might include compromised or publicly available data.
If you receive a package in a brushing scam, it may mean that your name and address have been compromised in a data breach. However, that doesn’t automatically mean the scammer has your Social Security number, bank account information or full identity.
If you're concerned that other personal information has been exposed, identity protection services such as Coveron and LifeLock can monitor for signs of compromised information, including data found on the dark web. These services won't prevent a brushing scam, but they can alert you to other potential risks involving your personal information.
Don't scan a QR code inside the package
A new "quishing" variation adds another layer of risk to the scam. Some scammers are sending out packages including a card with a QR code; the card might instruct you to scan the code to return the item, or it might include a message like, “Scan to see who sent your gift.”The QR code may direct victims to a phishing website designed to capture usernames, passwords, credit card information, birthdates, Social Security numbers, or other sensitive information. According to the FBI, QR codes in unsolicited packages might also lead to malicious software that could steal data from the victim’s phone.
If you receive an unsolicited package, don’t scan any QR codes that it might contain.
What to do if you receive a package you didn't order
If you receive a package you didn’t order, it might be a brushing scam. Here’s how to protect yourself:- Check your accounts. Log into your accounts on popular shopping sites, like Amazon. Check your order history and make sure that no one has hacked your account or used it to place an order.
- Check your transactions. Check your debit and credit card statements to verify that you haven’t been hacked or paid for the purchase. If you suspect your card information has been stolen, contact your credit card provider immediately.
- Change your passwords. Take a few minutes to change the passwords on your shopping accounts, especially if anything looks suspicious.
- Turn on two-factor authentication. Enable two-factor authentication on your shopping and finance accounts for an extra level of protection against fraud.
- Check your credit reports. If your address has been exposed in a data breach, other information may also be jeopardized. Check your credit reports for any unfamiliar accounts or activity.
- Report the package. Contact the retailer or marketplace to report the package, but don’t follow any QR codes or instructions inside of the package.
- Contact the FTC. You can report suspected package fraud to the FTC using the Report Fraud website.
- Request a review removal. If the scammer has posted a fake review under your name, contact the marketplace and request that it be removed.
- Dispose of contents appropriately. Many packages contain cheap items that you can dispose of. However, if it contains seeds, plants, foods, liquids or another substance that might be unsafe, follow agency guidance regarding the best disposal method. The USPS recommends that if you receive organic materials or unknown substances, you should contact the proper authorities, such as your state’s Department of Agriculture.
Can identity theft protection help after a brushing scam? Receiving an unsolicited package doesn't necessarily mean your identity has been stolen. But if your personal information has been exposed, you may want to monitor for signs that it is being used elsewhere.
Identity theft protection services can help with some of that monitoring. Coveron, for example, offers dark web monitoring that looks for exposed personal information, including email addresses, phone numbers and Social Security numbers. Depending on the plan, it also offers credit monitoring, financial account monitoring and alerts that could help you spot suspicious activity.Competitors such as Aura, IDShield and McAfee+ also offer identity and credit monitoring, though the specific features, number of credit bureaus monitored, insurance coverage and additional security tools vary by provider and plan. Compare the monitoring features you're most likely to use as well as the price before signing up.
Keep in mind that an identity theft protection service can't prevent someone from sending you a brushing package or guarantee that your information won't be exposed. Its value in this situation is monitoring for additional warning signs and, depending on the service, providing assistance if someone actually uses your information to commit fraud.
Protect more than your identity with Coveron's all-in-one protection
An unexpected package could be a sign that some of your personal information is already in the wrong hands.
Coveron includes identity theft recovery assistance, dark web monitoring, malware breach alerts and coverage for eligible online fraud and cyberattacks.
Kiplinger readers can save 70% on a two-year Identity Theft Protection plan with code KIPCOVERED.
That Unexpected Package on Your Porch Could Be a Scam
An unexpected delivery may seem harmless, but it could signal that your personal information has been exposed. Here’s what to do next.
www.kiplinger.com
Do you have to return something you didn't order?
Under Federal law, consumers can generally treat unordered merchandise as a gift, meaning you don’t have to pay for or return the merchandise. Alternatively, if you receive a package via the USPS and it has a return address, you can mark the unopened package "RETURN TO SENDER" and the USPS will ship it back at no charge to you.Just because you’re allowed to keep a package you didn’t order doesn’t mean you should use it. You don’t know where it came from or if it’s safe, so it’s best to be cautious regarding anything you’ve received.
Most importantly, a package scam may indicate that your personal information has been compromised online. If you receive a package you didn’t order, then consider tightening up your online protections, checking your account activity and closely monitoring your credit and debit accounts for any unauthorized activity.