“BRUSHING” IS THE NEWEST CYBER SCAM MAKING THE ROUNDS-AND IT ALL BEGINS WITH A SURPRISE PACKAGE IN YOUR MAILBOX.

The United States Postal Service (USPS) is alerting the public to a new phishing-related scam called “brushing” — and it’s arriving directly in people’s mailboxes.

The scam begins when a person receives an unexpected package, often appearing to come from a well-known retailer or online marketplace. These packages may lack a return address and typically contain inexpensive, random items like household goods. The catch? The recipient never ordered them.

According to the USPS, these packages are usually sent by international third-party sellers who have obtained the recipient’s personal information — such as their name and address — from the internet or through previous data breaches.

At this stage, recipients can assume their personal data has been compromised. But the deception goes further. After the package is delivered, the scammer uses the victim’s identity to post fake positive reviews online, falsely boosting the product’s ratings to increase future sales.

In some instances, recipients have even reported receiving harassing phone calls demanding payment for these unsolicited items.

“Whatever you do, DON’T pay for it and don’t fall for the scam. If you didn’t order the package, you’re under no obligation to return it or pay for it,” said a United States Postal Inspector.

“By law, unsolicited merchandise is yours to keep,” Avery added. “This is one of those rare situations where ‘finders, keepers’ actually applies.”

While the free item might seem harmless, the USPS warns that it’s a sign your personal information has likely been stolen or misused.

In more serious cases, scammers have even used a victim’s own online account and stolen financial details to place the order, then waited nearby to intercept the package once it’s delivered — all without the victim’s knowledge.