Short answer: it's mostly harmless on its own, sellers use it to fake reviews under your name, but the QR code sometimes tucked inside the package is the real danger.
It usually starts with an unexpected package. It looks like it's from a known company, or sometimes a business you've never heard of, and it's addressed to you. Inside is something cheap and random, baby wipes, toothpaste, seeds, nothing worth much.
Sellers do this to generate a "verified delivery," proof that a real order shipped to a real address, so they can post a glowing review under your name and boost their store's ratings. You never placed the order and never wrote the review, but on paper it looks legitimate.
Sometimes the package includes a note with a QR code, asking you to scan it to find out who sent it, or to process a return. Don't. Scanning can take you to a phishing site built to steal your card number, usernames, or passwords.
Receiving a package you didn't order can also mean someone has, or is trying to get, your personal information, since they needed your name and address to send it in the first place.
If you spot a brushing scam, you can report it directly to the FTC at ReportFraud.ftc.gov.
Source: FTC — That unexpected package you got could be a brushing scam
This is one trick out of dozens. The Scam-Proof Playbook covers online shopping scams, QR codes, AI voice cloning, and more, in plain language, with real examples.