A box shows up on your porch. Your name, your address, no receipt, no sender. Inside: a seed packet, a cheap ring, one sad pasta strainer.

You didn’t order it. So who did? A scammer, and here’s the kicker: The package isn’t a scam. YOU are the product.

 What’s going on

It’s called a brushing scam. Sketchy online sellers need glowing “verified purchase” reviews to climb the rankings. They buy your name and address (data breaches are the gift that keeps on giving), ship you something that costs them pennies, and boom, the system sees a real delivery to a real customer. Then they write a 5-star review of their junk product. Signed, basically, by you.

The U.S. Postal Inspection Service says it plainly: It’s illegal, and if you’re getting these boxes, your personal information is compromised. Not “might be.” Is.

 The dangerous new version

Lately these packages come with a little card: “Scan this QR code to see who sent your gift!” The FBI put out a formal alert about this one. That code can send you to a phishing site that harvests your card number, or it could push malware onto your phone. Curiosity is what they’re counting on.

The package is bait. The QR code is the hook. Don’t be the fish.

 Got one? Do this.

1. Keep it, toss it or donate it. Guilt-free. Federal law says unordered merchandise is yours to keep as a free gift. You owe nobody a dime.

2. Do NOT scan any QR code or visit any website printed inside. And never pay a “shipping fee” to claim a mystery gift.

3. Change the password on your Amazon and shopping accounts, and turn on two-factor authentication while you’re in there. If a scammer has your address, assume they’ve shopped for more.

4. Check your accounts for reviews you didn’t write and orders you didn’t place. Report fakes to the retailer. Amazon has a dedicated brushing report page.

5. Watch your credit at all three bureaus, plus card statements for small test charges.

6. Report it to Amazon or the marketplace it came from, the postal inspectors at 1-877-876-2455 and ic3.gov if there was a QR code involved.

FYI, the fake reviews themselves are a federal offense. The FTC can fine sellers over $51,000 per phony review.

So if a mystery box shows up this weekend, you know the drill. Keep the strainer. Skip the QR code. Change your passwords.