Received an Unexpected Package? It Could Be a Brushing Scam

Updated: Feb. 09, 2023

Finding an unfamiliar package on your doorstep could have a dangerous downside.

A surprise delivery might seem like a stroke of luck, but experts warn that it could actually cost you. Receiving an unexpected package might be a sign that your information was used in a brushing scam, according to the Better Business Bureau (BBB). In this new type of scam, sellers on Amazon or other shopping platforms will inflate their ratings by shipping products to an unsuspecting victim and posting a fake review in the victim’s name.

“It can be disconcerting to receive an unsolicited package, especially since they are often sent from overseas,” says Alex Hamerstone, a director with security consulting firm TrustedSec. Most of the time, you are not in any immediate danger, but it does mean that bad actors have access to your personal information, including your name, address, and even phone number. Other online scams like gift card scams, Amazon email scams, area code scams, and four-word phone scams can also put your personal information at risk.

So, should you be worried if an unexpected package shows up at your doorstep? We asked experts to weigh in on what a brushing scam is, how dangerous it could be, and what you should do if you receive a package you didn’t order. On the flip side, if you think your Amazon package was stolen, this is what you should do and how to stop porch pirates for good.

What is a brushing scam?

In a brushing scam, an online retailer sends people items and products they didn’t purchase in order to fraudulently improve their store’s ratings. Creating a fake transaction and mailing the item to a random person gives the seller credit for a sale, which boosts that seller’s rating on online marketplaces like Amazon. They may also write a fake positive review of the item in the recipient’s name to increase their rating even more. “The intention is to give the impression that the recipient is a verified buyer who has written positive online reviews of the merchandise,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center (ITRC).

The term brushing comes from a translation of the Chinese word for cleaning, according to Hamerstone. “[It’s] similar to how in English we talk about money laundering even though it has nothing to do with detergent and washing machines, because it makes the illicit money ‘clean,'” he explains. “The term brushing is used because the transaction is ‘cleaned.'”

Is brushing illegal?

Brushing scams are illegal in the U.S. and many other countries, according to the United States Postal Inspection Service (USPIS). But since most brushing scams are committed by overseas sellers, it’s often too difficult for U.S. authorities to track down these criminals. “The much bigger risk to the perpetrators is being banned from selling platforms like Amazon and eBay, which would affect their ability to earn a living,” Hamerstone says. Amazon and other online marketplaces prohibit brushing scams, so reporting the incident to the platform is the best way to hold that seller accountable, he adds. While online shopping sites have tried to crack down on fraudsters, shoppers should still watch out for the scams that can pop up on Facebook Marketplace, eBay, and Amazon.

Is brushing dangerous?

If you receive an item you didn’t order, it could mean that your personal information was compromised in a brushing scam. Scammers might have purchased your information from a database of compromised accounts on the Dark Web, which could leave you vulnerable to other crimes like identity theft in the future, according to Velasquez. On the other hand, fraudsters can often find this information on public data broker sites for free. “Whether we like it or not, our names and addresses are widely available in public and private databases all over,” Hamerstone says. “A scammer usually just needs the kinds of information available in a phone book to run a brushing scam.” Either way, you can protect your information online by following these tips to outsmart scammers.

What should I do if I receive a package that I didn’t order?

First, check the package to see if it was delivered to you by mistake. “If a package is addressed to your neighbor and delivered to you by accident, it isn’t yours to keep,” Hamerstone says. You can choose to keep or discard an unsolicited package addressed to you, or you can try to return it to the sender if a return address is listed.

In addition, Hamerstone recommends monitoring your credit card and bank accounts to make sure you weren’t charged for the item, and notifying authorities if the package contains anything suspicious. Victims can report brushing scams to the BBB Scam Tracker or contact the Identity Theft Resource Center to speak with expert advisors, according to Velasquez. However, “the most effective thing you can do is report it to the platform [such as Amazon or eBay], as the platform is most likely to be able to take action,” Hamerstone says. When you file a fraud report with the platform, you can also request that they remove the fake review written in your name, if there is one.

How can I protect myself from brushing scams?

Whether you are the victim of a brushing scam or want to prevent it from happening to you, there are steps you can take to protect your personal information going forward. Velasquez suggests changing your account passwords with unique 12-plus-character passphrases and frequently checking your financial accounts for any suspicious activity. “This is why good cyber-hygiene and online account management are so important,” Velasquez says. “The better you protect your personal information, the less damage an identity criminal can do.” As you reset your passwords, avoid these password mistakes that hackers hope you’ll make.

Next, read up on what doxxing is and how it can set you up to be hacked.