Got a package you didn't order? Federal law says it's yours to keep

What's happened

The FTC issued a fresh warning on August 20, 2026 about packages people never ordered. Recent reports to the agency say they usually hold something cheap and random, like baby wipes, toothpaste or seeds. Some now include a note with a QR code that says to scan it to find out who sent the package, or to process a return. The FTC says the code could lead to a phishing site that collects card numbers or logins.

These boxes are often part of a "brushing" scam. A seller ships a low-cost item to a real address so it has proof of delivery, then posts a fake review in your name to boost its ratings. The FTC says the package may also be a sign that someone has your personal information.

The good news is the law is on your side. With the holiday shipping season starting, it's worth knowing exactly what you owe for a surprise box, which is nothing.

What the law says

• It's a gift. Under 39 U.S.C. 3009, merchandise mailed without your "prior expressed request or consent" may be treated as a gift. You can keep it, use it or throw it away with no obligation to the sender.
• No bills allowed. The sender can't send you a bill or any dunning letters for it. Mailing unordered goods is an unfair trade practice under the FTC Act.
• Two exceptions. Sellers can send things clearly marked as a free sample, and charities can mail items with a request for a donation. In both cases the FTC says "it's your right to keep such merchandise as a free gift." You don't have to donate.
• No need to return it. The FTC says you don't have to pay for things you didn't order, and you don't have to send them back.

One caution: this covers goods sent to you without asking. A package addressed to someone else, or an order a family member placed, is a different matter.

A worked example

This is an illustration, not a real case.

Dana finds a small padded envelope addressed to her, with a $9 phone stand inside and a card that reads "Scan for your free gift and to rate your item." A week later, an email arrives asking her to pay $24.99 for "your recent order."

She owes nothing. The phone stand is hers to keep, and the bill breaks federal law. She doesn't scan the QR code or reply to the email. She changes her shopping passwords, reports the package to the marketplace it came through, checks her credit reports, and files a report at ReportFraud.ftc.gov.

A related trap is the "free gift, just pay shipping" offer online. The FTC warns that if you have to pay for shipping or fees to get a "free" trial, it's not really free. In one FTC case, people paid $4.99 in shipping and were billed about $90 two weeks later, then close to another $90 a month.

What to do now

1. Don't contact the sender and don't scan any QR code in the box. The FTC says anyone who responds will likely try to get more sensitive information from you.
2. Change your passwords on your online shopping accounts, in case one was compromised. A password manager such as NordPass makes unique passwords easier to keep.
3. Tell the marketplace if the package came through Amazon or another platform, so it can look into the seller.
4. Check your credit reports for free at AnnualCreditReport.com. The FTC suggests checking weekly for signs of identity theft.
5. Ignore any bill for the item. If a charge shows up on your card, dispute it with your card issuer.
6. Report it at ReportFraud.ftc.gov.

FAQs

What if the store sent it to me by mistake?

If it's clearly an honest error, like the wrong item in an order you did place, contact the seller. That isn't unordered merchandise, because you ordered something from them.

Is it safe to use a brushing item?

You're free to keep it, but the FTC advises being careful about using it, since you don't know who sent it. Be especially wary of seeds, food or anything meant to go on your skin.

Does a brushing package mean I've been hacked?

Not necessarily. Your name and address may simply be public. But the FTC says it can signal that someone has your information, so change passwords and keep an eye on your credit reports and statements.

Do charity "free gifts" mean I have to donate?

No. Address labels, cards or calendars a charity mails you are yours to keep, whether or not you give.

Sources: 39 U.S.C. 3009: mailing of unordered merchandise, FTC: what to do if you're billed for things you never got, or get unordered products, FTC consumer alert, August 20, 2026: that unexpected package could be a brushing scam, FTC consumer alert, January 6, 2025: got a package you didn't order?, FTC: free trials, auto-renewals and negative option subscriptions