Free toothpaste turns up in the post. It isn't a lucky mistake.

A package arrives addressed to you. You didn't order it. Inside is something cheap and slightly baffling - baby wipes, a tube of toothpaste, a packet of seeds. Nothing about it looks threatening, which is why most people shrug and keep it.

The FTC published an alert on 20 August explaining what's actually going on. It's called a brushing scam. A seller needs a delivery it can point to as real, so it ships something worthless to a genuine name at a genuine address. Once the tracking says delivered, it posts a glowing review under your name to brush up its ratings. You are the prop. On the plus side, the law is clear that you don't have to return unordered goods or pay for them.

The part that should give you pause is how they got your name and address in the first place. That combination usually comes from a data breach or a compromised shopping account, so the FTC suggests changing the passwords on your online shopping accounts, and telling the marketplace - Amazon or whoever - so they can look at the seller. Report it at ReportFraud.ftc.gov if you want it counted.

One extra detail from the reports: some of these packages include a note with a QR code, offering to reveal who sent the gift or to arrange a return. Don't scan it. It leads to a phishing page or a download, and the free item was never the point of the exercise. If a code like that has already sent you somewhere and something arrived on your PC afterwards, Tendvane's Safety check lists programs and browser extensions that installed themselves without being asked.