Get an unexpected package? It might be a scam

Have you ever received a package full of random items that you didn't order? If so, you might have been a victim of a scam that's targeting millions of people across the country.

Unexpected orders of random merchandise can indicate what's known as a brushing scam.

Brushing scams are used by some unscrupulous online retailers to bolster their businesses. Here's how they work:

Scammers create fake accounts, using real names and addresses, to place orders for their own products. This can be done by third-party sellers who are trying to achieve verified merchant status on a site.

Once that unsolicited package is shipped and delivered, they write a glowing fake review in your name to improve their product's rating. The goal is to make the product appear more popular and reliable.

While it sounds harmless, your personal information could be compromised.

"It's already telling us that our data is there, that we don't have control of our data," said Iskander Sanchez-Rola, the director of privacy innovation for Norton. "Maybe they obtain[ed] this information in a data broker site, or they actually were able to in a data breach -- in the dark web... Maybe that specific scenario doesn't look so problematic, but it tells us that something bigger is happening in the background. So, it's just the first step of something that could be very negative at the end."

Have a tip for the NBC10 Investigators? Email us at tips@nbcboston.com.

Here's what to do if you receive one of these mysterious packages:

1. Confirm with family and friends that it was not a gift meant for you.
2. If it was unsolicited, contact the seller or retailer about the mistake.
3. You can either discard the package or return to sender. The products are usually cheap and aren't very useful.
4. Change your account password and monitor your bank accounts closely for any unusual activity.
5. Consider freezing your credit, which will prevent anyone from trying to open anything in your name.
6. Report the incident to the Federal Trade Commission.

And don't ever pay for any packages you didn't order. If the seller reaches out to you or the delivery company says that postage is due, tell them you didn't place the order and want it returned to the sender.

Additional tips on brushing scams from Norton can be found on their website.