Brushing scams: What they are and how to protect yourself

Brushing scams are schemes where online sellers send out scam packages. This is done to create fake verified purchases and boost the sellers’ store rankings; they may even post positive reviews under your name for the unwanted products. While it might seem like harmless free stuff, brushing can signal that your personal information is exposed online.

Thankfully, it’s possible to protect yourself from these tactics of disreputable vendors with the right mix of awareness, online security tools, and smart reporting.

What is a brushing scam?

A brushing scam is a type of internet fraud that happens when an online vendor sends an unsolicited package (typically, of little value) to your address; many times, they’ve also created a fake account with your name that placed the order.

Once they’ve padded their sales figures with your “order,” it’s common for them to write a 5-star review with your “account.” It’s all done to artificially boost their product rankings and visibility in online marketplaces like Amazon or AliExpress.

Brushing entered the international spotlight around 2015, when media reports began calling attention to sellers in China sending fake orders to boost ratings. With the steady growth of business-to-consumer sales, there have been more and more brushing scam examples each year.

Technologies like QR codes have helped scammers to raise the stakes, too. When you scan such a code to see who the package is from or confirm its delivery, you may end up on a malicious website or have your device infected with malware. This phishing attack piggybacks on the brushing scam to try and steal your login credentials or payment details.

Being sent a random package in the mail might seem like a great deal (even though the products you’ll typically receive are cheap, random trinkets). Unfortunately, it’s also a sign that your personal data might have been used without your knowledge. You could be at risk of identity theft, because at the very least, your name and address have been leaked online.

Why do scammers send packages to random people?

Brushing scams help shady vendors look popular and trustworthy, so real shoppers notice their products. Plus, there are a few other benefits that scammers receive from sending you unsolicited packages:

• Obtain verified-buyer status: Sending a real shipment lets the seller post fake product reviews that platforms mark as “verified,” which often carry more weight with shoppers. Many platforms need legitimate tracking numbers from parcel services before they’ll verify an order, so these disreputable vendors can’t execute fake order scams purely digitally.
• Boost search ranking and visibility: Higher sales volume and good reviews push listings up in marketplace search results, attracting more organic buyers.
• Create social proof: A lot of positive reviews can make a low-quality product look more valuable, increasing conversion rates.
• Test or harvest addresses: Confirming a name and delivery address gives fraudsters usable data for future scams or targeted attacks. As mentioned above, they can also use QR code scams on the packages to steal more of your data.
• Cost-effective marketing: Sending inexpensive items with minimal shipping costs makes this a low-risk way to game algorithms compared with traditional ad spending.

How brushing scams work

Brushing scams are widespread and surprisingly effective. Understanding how they work can help keep you safe.

Here’s a breakdown of how brushing scams work:

1. Gather personal details: Scammers start by collecting names and shipping addresses from public databases or people search sites, indexes obtained from data breaches, or online marketplaces.
2. Set up fake buyer and seller accounts: Using those details, the scammers create accounts that appear legitimate on major e-commerce platforms.
3. Place fake orders: They then “buy” their own products using your address, which ensures that the parcel they ship has a genuine tracking record.
4. Post fake positive reviews: After delivery, the scammer logs back in to leave 5-star reviews under your name, giving the impression that you’re a satisfied customer.
5. Rinse and repeat: The scammer repeats the process at scale, often across hundreds of fake listings, to boost visibility, attract genuine buyers, and increase profits.

Who are the common targets of brushing scams?

Even if you’ve never interacted with the sellers behind the scam, anyone with a digital footprint that includes a valid shipping address is potentially a target.

You’re more likely to become a target if your data is easily available. Scammers often buy leaked or scraped databases that contain names, addresses, and phone numbers from old online orders or marketing lists. If you’ve ever bought something online, there’s a chance your details may have ended up in one of these troves.

If you’re a frequent online shopper, you’re more likely to be targeted, simply because your information circulates more widely across various platforms.

Risks of brushing scams

Being a victim of a brushing scam is usually harmless in terms of the physical items you receive. Most packages contain inexpensive or trivial goods. That said, there is no guarantee that the items are completely safe. For example, in the U.S., many people received unsolicited seed packets from overseas. Agricultural authorities advised recipients not to plant the seeds, because they could potentially include invasive species or pests. This illustrates that even seemingly harmless items can carry unforeseen risks.

The primary concern, however, is that your personal data, such as your name, address, and sometimes email, has been exposed or leaked. Once scammers have this information, it could be used for other fraudulent activities, including identity theft.

Another consequence is indirect: fake reviews posted under your name can mislead other consumers. By appearing as a “verified buyer,” your information helps boost a product’s rating, potentially causing other people to be scammed.

Finally, as we’ve seen above, brushing scams can also act as a piggyback for more malicious activity. Some packages include QR codes that, if scanned, can lead to phishing sites or malware that steal login credentials, financial information, or other sensitive data.

Signs you may be a victim of a brushing scam

There are a few simple brushing scam signs that can alert you early on. These range from unexpected packages arriving at your door to subtle changes in your online shopping accounts.

Receiving unordered packages

The clearest sign of a brushing scam is getting a package you never ordered. It will be sent to you by Amazon, USPS, or another courier, but the sender will likely be unknown.

Usually, when you open the package, you’ll find that it contains low-value items like phone cases, socks, or small gadgets. You might also find a QR code inside that encourages you to scan it to find out who sent the package.

Unfamiliar or foreign shipping labels

Another sign you might be caught up in a brushing scam is when the shipping label on the unsolicited package delivered to you looks unusual or unfamiliar.

Many of these scams originate from overseas sellers, often in regions where goods are shipped cheaply in bulk. Scammers rely on long, international shipping routes and vague return details to make their activity harder to trace.

If you receive a parcel that seems out of place, take a close look at the label. Hints that it may be a piece in a brushing scam include:

• Foreign return addresses that don’t match any recent orders you’ve made.
• Generic sender names like “Fulfillment Center” or “Online Seller,” instead of a recognizable retailer.
• Misspelled words or inconsistent formatting that suggest the label wasn’t printed by a major courier.
• Tracking numbers that don’t register on the courier’s official website.
• Customs declarations marked as “Gift” or “Low-Value” when you weren’t expecting anything from abroad.

While you shouldn’t flag every foreign shipment as a suspicious delivery, these label details can reveal when something’s off. This can indicate that your personal data may have been used to create a fraudulent order.

What to do if you receive a brushing scam package

Ignoring a brushing scam package might seem harmless, but it can cause more trouble than you’d expect. Mishandling the situation could leave your personal information exposed, allow scammers to keep exploiting your data, or even make you appear complicit in their fake transactions.

Should I keep or return the package?

Most countries’ laws don’t require you to return an unsolicited package, even if you suspect it might be part of a brushing scam. However, keeping it can inadvertently help cybercriminals continue their scheme.

If the parcel has a return address, returning it helps prevent scammers from using the delivery as proof of a completed transaction. Every successful delivery strengthens their fake sales history and makes it harder for online marketplaces to detect fraudulent activity. Sending it back unopened stops that process.

The package won’t always have a return address. If that is the case, you can simply throw it away or open it. If you do open the package and find anything suspicious, such as an unidentified substance or liquid, or organic items like food, seeds, or plants, you should notify the relevant authorities and follow their instructions.

Can I report a brushing scam to the marketplace?

In most cases, you can’t directly report a brushing scam to the marketplace, simply because you won’t know who the seller is. Brushing scams don’t use your real account, and the package usually arrives with a generic or untraceable return label, so you have no seller name, no order number, and no access to the transaction.

Many major platforms, like AliExpress, Walmart, or eBay, don’t offer brushing-specific reporting tools. Amazon is the notable exception, since it lets you report unsolicited packages and suspected brushing activity through a dedicated help page. If you received an unordered package from Amazon, proceed to the Report Unwanted Package form and provide the delivery details.

When you make the report, be sure to include details about the number of unwanted packages you’ve received, a tracking number from at least one of them, and any other relevant or identifying details about the package.

How to prevent brushing scams

While brushing scams can happen to anyone, there are steps you can take to reduce your exposure and protect your personal information:

• Protect your personal data: Only share your name, address, and contact details with trusted retailers. Avoid posting personal information publicly.
• Use strong, unique passwords: While account takeover is rarely a part of a brushing scam, it’s still a good idea to secure your online shopping accounts with strong passwords (a good password manager can help) and enable two-factor authentication (2FA) where available.
• Monitor your shopping accounts: Regularly check for unfamiliar orders, new payment methods, or unexpected reviews under your name.
• Don’t interact with suspicious QR codes or links: If a suspicious package includes a QR code, avoid scanning it unless you can verify its legitimacy.