An unexpected Amazon package may be brushing, a gift, or an order problem. Check orders and charges directly; do not use package links to share personal details.
Because the same address and identity details can later be reused in social-engineering scams, treat the shipment as a signal, not a harmless mystery.
| Step | What to do |
|---|---|
| 1. Confirm whether you were charged | Check your Amazon orders (including archived orders) and your card/bank statements. If there is a charge you do not recognize, treat it as account/payment fraud. |
| 2. Secure the Amazon account | Change your password, enable stronger sign-in protection, sign out of other devices, and remove unknown devices and payment methods. |
| 3. Report it through official channels | Contact Amazon support and report the unsolicited package so they can investigate seller abuse. |
| 4. Keep evidence | Photograph the shipping label, tracking number, and packaging. Do not throw it away until you have reported it. |
Do not: scan QR codes, call phone numbers printed on the package, or "confirm" your address to anyone who contacts you about the shipment. That is a common escalation path into identity theft.
What brushing looks like
Typical signs include packages you did not order, shipments addressed to you with strange product names, and deliveries that appear to come from Amazon logistics even though there is no matching order in your account. The goal is review manipulation and seller ranking, not the product itself.
If you were charged: or see unknown orders
If the package corresponds to an order you did not place, the priority is to stop financial damage and remove access.
- Change your Amazon password and review your sign-in/security settings.
- Sign out of all devices and remove anything you do not recognize.
- Remove unknown payment methods and shipping addresses, and review gift card balances if you use them.
- Contact your bank/card issuer about the transaction and ask about fraud options.
If you suspect the same password was used elsewhere, fix that next. Start with common mistakes creating passwords, then work outward from your email and payment accounts.
If you were not charged
Many brushing victims are never billed. The more durable risk is that your address is being used as part of a fraud workflow. Treat it as a signal to harden identity basics:
- Make sure your Amazon account uses a unique password and stronger sign-in (not just SMS).
- Check your account for new addresses or devices.
- Monitor your email for shipping confirmations you did not initiate.
Evidence to keep for a scam report
Keep the shipping label, tracking number, package contents, unexpected charges, and any enclosed QR code or request for information. Record dates, times, and what you actually did. Separate confirmed events from the other person's claims, and retain original files alongside screenshots.
After urgent account or payment action, you can organize the evidence in a Scam Incident Record. Keep the relevant messages and transaction details together for reporting and follow-up. You review and send information to the appropriate organization yourself; creating a record does not submit an official report or guarantee recovery.
Leave passwords, login codes, backup codes, and private keys out of incident notes or reports. Submit identity documents only when the verified official recovery process requires them.
How to report brushing safely
Use official support channels, not contact details printed on a label. Start with Amazon’s contact flow and report that you received an item you did not order:
Amazon Contact Us (you may be redirected to your regional site).
In the US, the USPS Inspection Service notes that brushing is illegal and tied to mail fraud patterns. Their overview is a good baseline reference for what qualifies as brushing and why reporting matters: USPS Inspection Service: brushing scam.
If you believe identity information is being abused beyond a single package, consider filing a report at FTC ReportFraud so there is a record across incidents.
Brushing is annoying because it is ambiguous. The decision point is simple: if money moved or orders exist, treat it as account/payment fraud. If not, treat it as an identity hygiene warning and lock down the accounts that control your delivery and payment surfaces.
Once the account is secured and reported, monitor for repeats. If the same pattern continues, it is often a sign that your address is in a seller database sourced from a breach rather than a one-off mistake.