What is a brushing scam? Why free packages raise red flags

A brushing scam is a type of e-commerce fraud that involves shady sellers sending you packages you didn’t order. Scammers create fake accounts using your name and address on online marketplaces like Amazon, “purchase” and ship items from their online store to your home, and then post glowing “verified” reviews in your name to boost their product rankings.

While surprise deliveries may seem harmless, they can indicate that your personal information is exposed on the internet, leaving you vulnerable to other, more harmful scams. In this article, we’ll break down how brushing scams work, the risks involved, and what steps you should take if an unexpected package shows up at your door.

How do brushing scams work?

Brushing scams involve fraudulent sellers sending packages to people who never placed an order. Before sending a product to a victim’s address, the scammer will first create a fake buyer account in their name. This allows them to pretend to be the victim in a made-up review that appears to come from a “verified buyer”.

Many of these scams take place on big online marketplaces like Amazon, eBay, and Temu, where fake reviews can quickly boost a product’s visibility and desirability. For example, when you search for a product on Amazon, the top results are usually those with high ratings and many reviews, making shoppers more likely to click on them instead of scrolling to the products hidden at the bottom.

Many brushing scams involve low-cost, mass-produced goods because they’re cheap to manufacture and can be listed at inflated prices once fake reviews push them higher in search rankings. For instance, one Reddit user reported getting multiple boxes of children’s clothes a day, while another ended up with dishwashing cloths. This might explain why you’ve received poorly made items that got lots of good reviews in the past.

Here’s how a brushing scam usually plays out:

1. Scammers track down personal details: They find names and addresses through people-search sites, data brokers, or even leaked information from data breaches that’s floating around on the dark web.
2. They create fake accounts: Using this stolen information, the scammers create fake buyer accounts on online marketplaces where their products are listed.
3. They “buy” and ship their own goods: These fake accounts are used to purchase products from the listing to be “brushed up” and the items are shipped to the victims’ address to make the purchases look legitimate.
4. They post fake reviews: Because the fake accounts are counted as “verified buyers,” the scammers can use them to leave glowing reviews on the relevant product listings to boost their visibility.
5. The cycle repeats: Some brushing scams involve thousands of fake accounts and reviews to make products appear popular and trustworthy.

What is the purpose of a brushing scam?

The purpose of a brushing scam is to artificially boost a seller’s reputation online. By sending out packages to real addresses, scammers can pose as “verified buyers” and leave rave reviews that push their products higher in search results. This makes them seem more trustworthy and ultimately drives more sales, often of low-quality goods.

Risks of brushing scams

Getting a surprise package might feel like a harmless bonus, but brushing scams can come with downsides. They often signal that your personal information — like your name and address — is circulating online. In some cases, that data could be misused in other scams or even identity theft.

Below are a few possible consequences of a brushing scam.

Personal and financial data exposure

While your name and address alone aren’t enough to steal your identity, brushing scams indicate that your information is circulating online. Scammers may find it through people-search sites, data brokers, platforms or forums where you post it, or even on the dark web if it was exposed in a data breach. And if other elements of your personally identifiable information are also exposed, it could be combined and used in identity theft.

Fake reviews tied to your name

When you’re caught in a brushing scam, the shady seller uses your name without your knowledge and links it to fake reviews. These may mislead shoppers into buying less-than-stellar products. In rare cases, if you have an account on that platform, your real profile could get caught in the mix and end up flagged or suspended during a fraud investigation.

Repeat scams

If a brushing scam succeeds, scammers are more likely to try it again — which could lead to a stream of packages showing up on your front porch. This wastes your time and energy, whether you choose to keep the items and repeatedly recycle the packaging, or donate or return them.

Safety issues

While most items from a brushing scam are harmless (albeit cheaply made), some packages can pose real safety risks. It’s generally recommended to avoid using cosmetics, electronics, or other potentially unsafe products.

For example, people in Alabama, Texas, and New Mexico recently reported receiving seeds sent from China as part of a brushing scam. State officials warned against planting them, as they could grow into invasive species that threaten local ecosystems.

Malware and quishing attacks

Some brushing scam packages include QR codes that may look like they’ll help you track or learn more about the delivery. However, scanning these codes may lead to malicious websites designed to steal sensitive data or install malware onto your device. This tactic is known as “quishing” or QR code phishing.

What are the signs of a brushing scam?

The most obvious sign of a brushing scam is receiving a package you didn’t order in your name. While it could be a surprise gift from someone you know, or an honest mistake, it could also indicate a brushing scam.

Here are the signs of a brushing scam:

• Unordered delivery: You receive a package that you never ordered, and that you’re certain hasn’t been sent to you by a friend or family member.
• No return address: The sender’s details are missing or unclear, meaning there’s no way for you to return the package to the sender.
• Suspicious QR codes: Some brushing scam packages have random QR codes that may lead you to a malicious website.
• Fake reviews tied to your name: You spot your name being used in an online product review that you didn’t write.

What to do if you receive a package you didn’t order

If a strange package lands on your doorstep, don’t panic. You’re not legally required to do anything. However, taking the following steps to report it and safeguard your data can help prevent these scams from spreading and improve your data privacy.

1. Keep, discard, or return the package: You’re legally allowed to keep unordered merchandise. But since most items sent in brushing scams are cheap and random, you may want to return or donate them. Discard them safely if they could pose a hazard.
2. Don’t pay for the packages: Never pay for unsolicited deliveries. If a seller or delivery service claims you owe postage, let them know you didn’t place the order and want it returned to the sender.
3. Contact the marketplace or store: Report the package directly to the platform it was supposedly ordered from (like Amazon) if you know. Online marketplaces don’t allow brushing scams and may investigate or remove the seller.
4. Look for signs of account compromise: Check through your online shopping accounts, looking for any strange activity or purchases you didn’t make.
5. Update your passwords: While brushing scams don’t typically present any risk of subsequent cyberattacks it doesn’t hurt to be safe. Password security is your first line of defense online, so create strong, unique passwords that are at least 15 characters long for each account.
6. Set up 2FA: Add two-factor authentication (2FA) to accounts where you've received brushing scam packages. This layer of security uses your phone number, email address, or an authenticator app to verify your identity, making break-ins harder.
7. Reduce your digital footprint: You could be getting targeted in brushing scams because your address is listed on data broker sites. Remove your personal information from the internet where possible to limit who can see your personal details. You can remove your data from data broker sites by opting out manually or using an identity theft protection service.
8. Run a dark web scan: Use a service that checks if your personal data is floating around the dark web to see if you can find where your name and address might have been stolen from. Ongoing dark web monitoring can alert you if your info is found again in the future.
9. Monitor your credit: After a brushing scam, keep an eye on your credit reports and accounts. If you suspect fraud, consider placing a credit freeze or lock.
10. Protect your identity: Identity theft protection services, like LifeLock, help detect suspicious activity, scan people-search sites for your information to help you opt out, and include dark web monitoring.

How to report a brushing scam

Reporting brushing scams helps retailers and regulators identify scammers and stop fake reviews, or worse scams, from spreading. If you’ve received an unsolicited package, here’s how to report it to some of the most popular platforms and the Federal Trade Commission (FTC):

• FTC: Submit a complaint at ReportFraud.ftc.gov.
• Amazon: Fill out the Report Unwanted Package form.
• Temu: Go to the Support Center on Temu’s website or app.
• eBay: Report suspicious sellers or fake reviews to the eBay Security Center.
• Walmart: Use the Report Seller Activity form to report this Walmart scam.

Protect your information, online and off

Now that you’ve brushed up on how these scams work, remember that the real risk is your personal information being out there on public databases or dark web sites without you even knowing it. Brushing scams are a reminder that fraudsters can put your data to use in unexpected ways.

Join LifeLock Core for privacy and dark web monitoring features that help you detect where your personal data is exposed so you can take action to safeguard against potential scams, fraud, and identity theft. LifeLock’s automatic data removal feature can help you reduce your exposure on data broker sites by scanning leading brokers and automatically requesting your personal details be removed.

FAQs

Can you keep items sent to you as part of a brushing scam?

Yes, you can. Federal law says you can’t be forced to pay for items you didn’t order, and don’t need to return them. However, it’s best to be cautious if you decide to keep a random product, since some items may be cheaply made or unsafe.

How do scammers get my name and address for a brushing scam?

Scammers can obtain your information in a few ways: from data brokers, public records, information you post online, or through information leaked in data breaches and sold on dark web websites.

Why is it called brushing?

It’s called a brushing scam because the scammer “brushes up” the reviews of their products — posting fake, embellished reviews to create the illusion of popularity and quality. Some also describe it as “brushing aside suspicion,” since the fake reviews make the products seem trustworthy.

What should I do if I receive an Amazon package I didn’t order?

Contact Amazon to report the issue. Amazon will investigate and take steps to help prevent the scammer from continuing their brushing scam. You can keep the merchandise, return it, donate it, or dispose of it.

How do I stop Amazon brushing scams?

Report any suspicious packages directly to Amazon. They will investigate, remove fake reviews, and may ban the seller from the marketplace to stop them from running further Amazon scams.

Are brushing scams dangerous?

Brushing scams themselves are often harmless in terms of the product, but they can indicate that your personal information is available online for scammers and other bad actors to find. Some items may also pose safety risks, so it’s important to handle unknown packages with caution. And never scan a QR code on an unordered package, because it could be a quishing scam.