There are particular seasons, like during the holidays, where packages are showing up on my doorstep constantly. Between grandparents sending gifts for the kids, orders of cleaning and pet supplies, household goods, decorations, gifts I've ordered, and gifts I don't have any idea are coming, I'm hauling boxes in and out almost all day.
So it's not altogether a surprise when a box shows up and I'm not entirely sure who it's from. It could be something sent from a godparent or a great-aunt. It could be a late gift from a grandparent or an unaddressed gift from my sister. Or, it could be a scam.
What is a brushing scam?
A brushing scam is when a seller sends you an item or a product that you didn't order. Why would anyone do this? The reason is because it allows them to post a fake "verified purchase" review under your name. And why would they want to do that? Because fake reviews can boost a product's ranking and credibility.
Brushing scams follow a predictable pattern: A scammer creates or uses their shady seller account on a retailer site or marketplace like Amazon, AliExpress or Temu. They get your name and address through a data breach or illegal database, then they "order" their own product and send it to you (free of charge).
Once the shipment has been confirmed as delivered, which is proof that a real customer received the item. They can post a "verified" review under your name and their seller rating gets a boost. Next, their product gains visibility and drives sales up.
These scams often involve lower value items, sometimes smaller electronics or gadgets, home goods, accessories, makeup or beauty products. Even jewelry or seeds have been known to be sent. It it feels random, or unusually cheap, it could be a brushing scam. And it's the kind of malicious behavior that increases during busy shipping periods like the holidays.
What's dangerous about brushing scams?
It may seem like a harmless scam – after all, someone is just sending you things for free so what's the harm? However, consider the part above about people purchasing your home address off the internet. That means that people you don't know online have your home address and your personal information is being bought and sold between some iffy characters.
That means more of your information is likely easily available as well. So it's time to do a security check of your accounts, reset some passwords and invest in the best identity theft protection at the very least.
There are other risks as well: Some platforms will flag or freeze your account if fake reviews are posted under your name. Fake reviews can increase trust in low quality products, which can lead buyers to visiting malicious sites. And some unsolicited items can be unsafe, counterfeit, banned or expired.
What should you do if you receive a mystery package?
While you have no legal obligation to return the item (because you didn't order it), it's still often advised that you don't use or consume it. Why? Because the low-cost items in question are often of a poorer quality which means they may not be safe.
You should absolutely report the item via the platform's internal reporting function which will help them investigate fraudulent sellers. You should also check your account for any suspicious activity or purchases, and update your passwords (either manually or through your password manager). We also recommend updating passwords for any related email or payment accounts as well as taking the time to enable two-factor authentication for all of these accounts (if you haven't already).
You should monitor your bank and credit cards for any unusual activity, and if you already have an identity theft protection service, make sure you have it set up to alert you if it notices your personal information is being misused online or in the real world.
Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.
More from Tom's Guide
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
