Someone targeted by a brushing scam typically finds out when a small package turns up with their name and address on the label, but they have no record of ordering it in any of their online shopping accounts.
Unlike scammers who send fake delivery texts to trick people into clicking a link, brushing scammers send a real item, although some have started adding QR codes to the packages that lead to phishing sites.
What is a brushing scam?
A brushing scam is a scheme in which an online seller sends you a product you didn’t order, then uses the delivery to post fake reviews or inflate its sales. The seller usually wants a better ranking, not your money.
The term comes from Chinese e-commerce slang for faking orders to improve a store’s sales record. Sellers use it as a confidence trick on other online shopping customers who trust star ratings and sales numbers, and the person who receives the package is usually not involved in the scam at all.
A typical case might be a phone stand arriving in a plain mailer from a seller you’ve never heard of.
- Brushing scams use unsolicited packages to post fake reviews or inflate sales, usually without charging the recipient anything.
- Scammers usually get names and addresses from public records, data brokers, or customer data exposed in a company breach.
- Receiving a brushing package doesn’t mean your shopping account or payment details are compromised.
- Don’t scan QR codes in unexpected packages, because some lead to phishing sites that steal logins or payment details.
- In the US, federal law generally lets you keep unsolicited merchandise without paying for it.
- Report the package to the marketplace so it can investigate the seller, although more packages may still arrive.
How does a brushing scam work?
In a brushing scam, a seller may create a fake marketplace account using your name and address, purchase its own product, and ship it to you. The seller then uses the fraudulent transaction to manipulate reviews or sales rankings.
Scammers usually pay with their own card and use their own email address, so the order and the charge don’t appear in your account. Any reviews come from the account they control, sometimes under a name that looks like yours.
Many consumers compare products by star ratings and sales rankings, so a listing with hundreds of positive reviews may rank higher and attract more buyers, which can make the cheap shipments worthwhile.
Sending a package doesn’t automatically produce a verified review, because each marketplace sets its own rules for confirming purchases and removing fake reviews. Amazon, for example, labels a review “Verified Purchase” when it can confirm the reviewer bought the item on Amazon, and brushing is one way sellers try to get that label.
How do scammers get your name and address?
Scammers usually get names and addresses from public records, data brokers, or customer data exposed in a company breach. Having your address doesn’t mean they can access your shopping accounts or payment details.
People who ask how brushing scams get their address often worry about a hacked Amazon account, but a name and address are personally identifiable information that many companies and directories already hold. The shipping label won’t tell you whether the seller found yours in a breach, a public directory, or a purchased list.
Independently tested and awarded by the industry's leading labs.
How can you recognize a brushing scam?
You can usually recognize a brushing scam by a package that arrives from an unknown seller and doesn’t match any order in your household. The item is often cheap, and there’s often no note or invoice with it.
Sellers often choose low-value merchandise such as phone accessories, hair clips, or small household products, because these items cost little to buy in bulk and ship. Many reported cases involve Amazon, but an Amazon brushing scam works the same way as one on any other online marketplace that ranks products by reviews and sales.
Before you treat a package as brushing, check whether it could be a gift, a subscription shipment, an order from someone in your household, or a parcel meant for a neighbor.
Are brushing scams dangerous?
Brushing scams can pose privacy and security risks, although their primary purpose is to manipulate online reviews rather than steal money. Some suspicious packages also contain malicious QR codes or potentially unsafe products, creating additional risks for recipients.
A seller who has your name and shipping address isn’t the same as confirmed identity theft, a compromised account, or stolen payment information. Your details may still be resold or reused, though, so the same information could turn up later in phishing emails, scam calls, or other fraud attempts.
Whether your situation is serious depends on evidence of misuse, such as orders you didn’t place or unfamiliar charges, rather than on the package itself.
Can brushing scams involve malicious QR codes?
Yes, some brushing scams include a card or sticker with a malicious QR code, often with a note asking you to scan it. Scanning one may open a fake website built to steal logins, payment details, or one-time verification codes.
In its analysis of unexpected parcels, Kaspersky describes QR code cards that promise a $100 gift card for leaving a review, claim to reveal who sent the “gift,” or ask you to confirm receipt of a free item. Some of the sites behind these codes also prompt you to install an app that turns out to be malware.
This tactic is known as quishing, short for QR code phishing, and it’s an extra threat some scammers add to brushing rather than part of how brushing itself works. Scanning a code doesn’t automatically infect a phone or compromise an account, and problems usually start only if you type a password or card details into the site or install an app it asks you to download.
What should you do if you receive a brushing scam package?
Most people only need to rule out a household order and report the package. You usually don’t need to freeze your credit, replace cards, or change every password unless you find signs of account compromise, payment fraud, or identity misuse.
Check your shopping accounts and payment activity
Start by asking the people you live with whether anyone ordered the item or sent it as a gift and rule out a subscription shipment you’d forgotten about. If there’s no explanation, look through recent orders in your marketplace accounts, your card and bank transactions, and any security emails about new sign-ins or password changes.
When you find an order, charge, or sign-in you don’t recognize, change that account’s password, turn on two-factor authentication, and contact the platform and your bank.
Report the package to Amazon or the relevant marketplace
To report a brushing scam on Amazon, use the reporting form on its help page for unsolicited packages. On other marketplaces, contact customer service on the site the package came through. Keep the shipping label, tracking number, and delivery date, and take photos of the package and its contents, because Amazon asks for a tracking number and the number of unwanted packages you’ve received.
If a suspicious package arrived by USPS, you can also report it to the United States Postal Inspection Service (USPIS) through its online crime reporting form. Reports about repeated shipments may help a marketplace find the seller and remove fake reviews posted in your name, but they can’t guarantee the deliveries will stop.
What should you do with an unsolicited package?
In the US, federal law generally lets you keep, use, or throw away unsolicited merchandise without paying for it or notifying the sender. A package addressed to someone else is a misdelivery, so return it through the carrier or sender.
If an unopened package shows a return address, the US Postal Inspection Service says you can mark it “return to sender” and it will go back at no cost to you. Other countries set their own consumer rights and return rules, so check your national consumer protection agency’s guidance if you live outside the US.
Take more care with unfamiliar electronics, consumables, seeds, or unknown substances by not plugging unknown USB drives into your devices, not planting the seeds, and reporting suspicious liquids or powders to local authorities. If you’re reporting the package, take your photos before you throw any of it away.
What should you do if you scanned a suspicious QR code?
Close the page without entering any details, which is usually enough if you only scanned the code. If you entered a password, card details, or a verification code, or installed an app, secure the affected account or device.
After entering a password, change it on the official website and on any other account where you used the same one, then turn on two-factor authentication and check for sign-ins you don’t recognize. Contact your bank or card issuer if you entered card details or a one-time verification code, because it can block the card and check for fraudulent charges.
Anyone who installed an app from the link should remove it and scan the device with reputable security software to check for malware.
How can you reduce the risks of brushing scams?
You can reduce the risks by sharing less personal information online, securing shopping accounts with unique passwords and two-factor authentication, and ignoring QR codes in unexpected packages. You can’t stop the packages themselves, because the seller already has your address.
You can protect your personal details and the accounts linked to them with these steps:
- Keep your address off public social media profiles, and ask people-search sites to remove your listing where they offer an opt-out.
- Use a strong, unique password for each shopping account, so a password stolen in one breach is harder to reuse elsewhere. A password manager can create and store them for you.
- Turn on two-factor authentication and sign-in alerts for marketplace and payment accounts, so you’re more likely to notice a takeover attempt early.
- Don’t scan QR codes in unexpected packages, and use security software with phishing protection, which can help block fake sites if you scan one by mistake.
Related Articles:
- How safe is online shopping
- Managing and preventing a personal data breach
- What to do after a phishing attack
- Learn more about Top scams how to avoid becoming a victim
Related Products:
FAQs
Can a brushing scam get my shopping account suspended?
Receiving a brushing scam package does not normally result in your shopping account being suspended. However, if fraudulent activity is linked to your account, the marketplace may investigate or restrict it. Contact customer support if you notice suspicious activity.
Are brushing scams more common during the holidays?
Brushing scams may be harder to recognize during the holidays because people receive more packages and gifts. However, there is insufficient evidence that these scams consistently increase during the holiday season. They can occur year-round.
How can you spot fake reviews created by brushing scams?
Look for clusters of five-star reviews posted within a few days, vague praise that doesn’t describe the product, and reviewers with no other activity. A “Verified Purchase” label doesn’t prove a review is genuine, because brushing creates real deliveries.
Is brushing illegal?
Yes. The US Postal Inspection Service identifies brushing as an illegal practice. In the US, the Federal Trade Commission’s 2024 rule also prohibits certain deceptive review practices associated with brushing scams, including creating or purchasing fake customer reviews.
