The Unexpected Package That Should Worry You
A brushing scam is a type of e-commerce fraud where a seller sends you a package you never ordered — then uses your name and address to post fake "verified purchase" reviews online, boosting their product ratings artificially.
Here's the quick version:
- You receive a package you didn't order
- A scammer used your personal details to place a fake order in your name
- They post a glowing 5-star review under your account or a fake account tied to your address
- Their product climbs the rankings — and your personal data has already been compromised
That last point is the one most people miss. The free item isn't a gift. It's a signal that someone already has your name, address, and possibly more.
In 2021, consumer group Which? estimated that over one million UK households may have been targeted. In 2024, Amazon reported blocking more than 275 million suspected fake reviews, many connected to brushing activity. This isn't a fringe problem — it's widespread and growing.
The packages are usually cheap: plastic jewelry, LED lights, phone cases, seeds, or random household items. They often arrive with no return address, or with a retailer's generic address. They feel harmless. They aren't.
If you've just received a mystery package, your personal information is likely already out there — and that's the real threat to take seriously.
What is a Brushing Scam and How Does It Work?
At its core, a brushing scam is a deceptive tactic used by third-party sellers on major e-commerce platforms like Amazon, eBay, or AliExpress to "brush up" their sales numbers and search rankings. In the competitive world of online shopping, a product with 5,000 five-star reviews will always outsell a product with none. Scammers know this, and they use your identity to manufacture that credibility.
When we see a "Verified Purchase" badge on a review, we tend to trust it. To get that badge, a transaction must actually take place. The scammer creates a fake account, uses your stolen name and address, and "buys" their own product. They then ship a cheap, lightweight item to your house. Once the tracking number shows the package was delivered, the seller can post a glowing review as a verified buyer.
According to the Brushing Scam – United States Postal Inspection Service, this isn't just a nuisance; it's a calculated manipulation of the marketplace. For more on how these parcels fuel the fake review industry, check out this guide on What are brushing scams? - Which?.
The Mechanics of a Brushing Scam
The process is surprisingly streamlined. Scammers use automated software to create thousands of fake accounts. They then place orders for their own low-value inventory. By shipping these items to real people, they generate valid tracking numbers that satisfy the platform's algorithms.
This creates a "sales volume" spike. Most e-commerce search engines prioritize products with high sales velocity and positive feedback. By "brushing" their way to the top, these sellers can inflate their rankings ten times faster than an honest seller. Once they reach the first page of search results, they start making real money from unsuspecting customers who believe the fake reviews are genuine.
Why It Is Called "Brushing"
The term originates from the Chinese e-commerce market (specifically the term shua dan). It refers to the act of "brushing" or "cleaning" a seller's profile to make it look spotless and successful. Just as you might brush away dust to reveal a clean surface, scammers "brush" their storefronts to hide their lack of real customers and replace it with a facade of high-volume, high-rating success.
Why You Were Targeted: Data Privacy and Risks
You might be wondering, "Why me? I didn't sign up for any free samples." The truth is that your name and address are valuable commodities on the dark web. If you've received an unordered package, it means your Personally Identifiable Information (PII) has been leaked.
Scammers don't pick names out of a hat. They obtain lists of names and physical addresses from various sources, including:
- Data Breaches: Large-scale hacks of retailers or social media sites.
- Data Brokers: Marketing firms that sell your "public" information to the highest bidder.
- Phishing: Information you might have accidentally provided on a fake website.
This is why we emphasize the importance of understanding What is a Phishing Scam? Protect Yourself. If a scammer has enough info to send you a package, they might have enough to try more serious identity theft. Even platforms that seem safe can have risks; for example, many users ask Is Temu a Scam? Site Safety Risks & Truth About Cheap Deals because of the sheer volume of low-cost items moving across borders.
How Scammers Obtain Your Information
Scammers often buy "lead lists" from illicit forums. These lists can contain millions of entries harvested from compromised databases. Sometimes, they even use public records or "people finder" websites to verify that an address is active. By sending a cheap item and seeing it successfully delivered, they confirm that your data is "live," making it more valuable for future, more dangerous scams.
The Dangers of Unsolicited Packages
While a free pair of cheap earbuds might seem like a win, there are hidden dangers. In 2020, thousands of people received mystery seeds from China. The USDA warned that these could be invasive species or carry diseases that threaten local agriculture—a major biosecurity risk.
Furthermore, some items might be made of toxic materials that don't meet safety standards. There is even a risk of "malware-laden" gadgets. If you receive a USB drive or a "smart" device you didn't order, do not plug it into your computer. It could be a Trojan horse designed to steal your passwords. As noted in the "Brushing" Scam Behind Fake Reviews and Ratings.html, the "free" price tag often comes with a much higher cost to your security.
Latest Variations and the QR Code Brushing Scam
Scammers are constantly evolving. The latest trend involves "Quishing" — or QR code phishing. Instead of just a cheap item, you might receive a postcard or a "thank you" note inside the package featuring a QR code.
The note might claim you've won a gift card or that you need to scan the code to see who sent the "gift." Once you scan it, you are directed to a fake website that looks like a legitimate retailer's login page. If you enter your credentials, the scammer now has full access to your real account. This evolution is covered in detail in A brush with online fraud: What are brushing scams and how do I stay safe?.
Common Items Sent in Brushing Scams
To keep costs low, scammers ship items that are light and cheap to mail internationally. Common "gifts" include:
- Suzhichou scarves: Low-quality silk-imitation scarves.
- LED lights: Small, battery-operated gadgets.
- iPhone cases: Usually for older models.
- Strawberry eyelash cleaner: Or other obscure beauty products.
- Seeds: Often labeled as jewelry to bypass customs.
Identifying a QR Code Brushing Scam
A legitimate gift from a friend will usually have a gift receipt or a personal note. A brushing scam package with a QR code will often have:
- Vague messaging: "Scan to claim your reward" or "A surprise is waiting."
- Urgency: "Limited time offer" or "Scan within 24 hours."
- Mismatched branding: The postcard might look like it’s from Amazon, but the URL it leads to is a string of random letters and numbers.
Immediate Steps to Take After Receiving a Package
If a mystery box lands on your porch, don't panic, but don't ignore it either. Here is what we recommend doing immediately:
- Do Not Pay: You are under no legal obligation to pay for merchandise you didn't order.
- Check with Family: Ensure it wasn't a surprise gift from a relative.
- Report to the Retailer: If the package has Amazon or eBay branding, contact their customer service. Amazon has a specific "Report Unsolicited Package" form.
- Change Your Passwords: Even if the scammer didn't hack your account yet, they have your PII. Change your passwords for major shopping sites and enable Two-Factor Authentication (2FA).
- Refuse the Package: If you haven't opened it, you can take it back to the post office and mark it "Return to Sender."
Be wary of follow-up emails as well. We have seen cases where the physical package is followed by a fake email. Learn PayPal Scam Emails: How to Spot Them and How to Confirm ParkMobile Scam Text to stay sharp against these multi-channel attacks.
Legal Rights Regarding Unordered Merchandise
In the United States, the Federal Trade Commission (FTC) is very clear: if you receive merchandise you didn't order, you have a legal right to keep it as a free gift. You do not have to return it, and you certainly don't have to pay for it. However, given the safety risks mentioned earlier, we usually recommend disposing of the items rather than using them.
Monitoring for Identity Theft
Receiving a package is a "red flag" that your data is exposed. You should:
- Check "Have I Been Pwned": See if your email was involved in a recent breach.
- Audit Bank Statements: Look for small "test" charges of $1 or less.
- Consider a Credit Freeze: This prevents anyone from opening new lines of credit in your name.
- Review Account Activity: Check your "Orders" history on Amazon to ensure the scammer didn't actually use your saved credit card.
For more tips on protecting your money, see our Cash App Scam Alert: 7 Tricks Draining Accounts Right Now.
How to Prevent Future Brushing Scams
While you can't always "un-leak" your data once it's out there, you can build a digital firewall around your future activities. Prevention is about reducing your "attack surface."
Securing Your E-commerce Accounts
The most important step is to stop using the same password for every site. Use a password manager to create unique, complex passwords. Additionally:
- Enable 2FA: This ensures that even if a scammer has your password, they can't log in without a code from your phone.
- Remove Saved Payment Methods: It’s slightly less convenient, but not having your credit card "on file" prevents scammers from making unauthorized purchases if they do get into your account.
- Opt-out of Data Brokers: Use services that help you remove your name from "people search" sites.
Advanced Privacy Tools
At Tempo Mail USA, we believe the best way to stay safe is to never give out your real information in the first place. When you sign up for new newsletters, rewards programs, or one-off shopping sites, use a temporary email alias.
Our aliases act as a PII firewall. If a site you used is breached, the scammers only get a proxy email that isn't tied to your real identity or your primary inbox. This prevents the initial data harvesting that leads to a brushing scam. By shielding your real email, you significantly reduce the chances of your physical address being linked to your digital footprint. Learn more about these methods in our guide on What is a Phishing Scam? Protect Yourself.
Frequently Asked Questions about Brushing Scams
Is it legal to keep items from a brushing scam?
Yes. According to the FTC and USPS, you are legally allowed to keep unsolicited merchandise as a gift. You are not required to pay for it or ship it back. However, for safety reasons (especially with electronics or seeds), it is often better to throw the item away.
Does receiving a package mean my credit card is compromised?
Not necessarily. In most brushing scams, the scammer pays for the item themselves using their own funds. They just use your address to create the "verified purchase." However, it is a sign that your name and address are in the hands of criminals, so you should monitor your accounts closely just in case.
How do I report a brushing scam to the USPS?
If the package came through the mail, you can report it to the U.S. Postal Inspection Service (USPIS) via their website. You should also report the incident to the Federal Trade Commission at ReportFraud.ftc.gov.
Conclusion
A brushing scam might look like a harmless mistake or a "free gift," but it is actually a warning sign. It tells you that your personal information is being traded in the darker corners of the internet. By understanding the mechanics of these scams—from the "brushing up" of sales rankings to the dangerous evolution of QR code "quishing"—you can take the steps necessary to protect yourself.
Don't let scammers use your identity as a stepping stone for their fraudulent businesses. Stay vigilant, monitor your credit, and report unsolicited packages immediately.
At Tempo Mail USA, we are dedicated to helping you stay one step ahead of fraudsters. Our temporary email aliases provide a secure PII firewall, ensuring that your real identity remains private even when you shop online. By shielding your personal information, you can stop the cycle of data theft before it ever reaches your doorstep.
Protect your privacy today at tempomailusa.com.