What's a "Brushing Scam" and Why Did I Get a Package I Never Ordered?

Aug 10

You didn't order it, you didn't pay for it, and you definitely didn't ask for it. So why is it sitting on your doorstep?

Risk Level

Read Time

"Wait, I got a package I didn't order. What's going on?"

You check your porch and there's a box waiting for you. You didn't order anything, but here it is anyway. Maybe it's a set of cheap earbuds, a phone case, or a pack of seeds you've never heard of. The package does not have a return address, there is no invoice inside, and you definitely do not have a charge on your credit card. While this may seem like a happy little accident, it isn’t a mistake, and it isn't a gift - It's called a brushing scam, and it occurs far more often than you'd think.

"Okay, so if I'm not being charged, what's the catch?"

Here's the trick. Scammers running online storefronts want their products to look popular, because products with more reviews often appear more appealing to shoppers. In order to cash in on that manufactured popularity, scammers need "verified purchases" tied to real names and real addresses. In order to appear legit, purchases are made using stolen or leaked personal information, such as your name and address, pulled from a data breach or scraped from somewhere online. The items are shipped to real addresses and, because the item was free, the receivers often do not consider that anything would be amiss.

Once the package arrives at your door, the scammer can post a glowing review under your name, counting as a very real review for a fake purchase of an item that you never actually wanted.Your address simply becomes a prop in someone else's scheme to inflate the ratings on unreliable or, worse, potentially dangerous products. .

"So this is happening because my information got leaked?"

Pretty much. If you've received a mystery package, it's a strong sign that your identifiable information (name, address, etc.) have been leaked in some way.Whether that's an old data breach, a sketchy website you handed your information to, or a public record that got scraped, your information is readily available for a wide variety of nefarious purposes. The good news is that a brushing scam itself usually isn't inherently dangerous. - Nobody is charging your accounts or breaking into your electronic devices directly as part of the scam. It is, however, a red flag worth paying attention to.

"Wait, could this actually trace back to a real cyber attack on my data?"

It's possible, and that's exactly why a brushing scam is worth taking seriously even though the package itself is harmless. Somewhere down the line, hackers may have carried out a cyber attack against an organization that stored your information - a retailer, a shipping company, or even a service you signed up for years ago and forgot about. When hackers pull off that kind of data breach, they don't always use the stolen information themselves. Instead, they often package it up and sell it to other hackers or scammers on the side.

From there, the information can pass through several hands before it ends up with someone running a brushing scheme. That person doesn't need to know how to hack anything; they just need a list of real names and addresses to buy. So while the box on your porch seems harmless, it may be the tail end of a data breach that happened months or even years earlier, at an organization you may not even remember doing business with.

"That's unsettling. How would I ever figure out where the breach happened?"

Honestly, you may never pin down the exact source, and that's okay. Data breaches often get combined into massive collections that circulate online, mixing information from dozens of organizations together. Rather than chasing down which single breach is responsible, it's more useful to treat a brushing scam as a signal that your information is already out there, and to focus on locking things down going forward.

"That's a relief. So what should I actually do about it?"

A few simple steps go a long way:

Don't scan any QR codes on the package. Some brushing scams include a QR code that claims to explain what the item is or how to leave a review. Scanning it can lead to a fake site designed to steal your information treat it the same way you'd treat a suspicious link in a text message.
Check your accounts anyway. Even though brushing scams don't usually come with a charge, it's still worth a quick look at your bank and credit card statements just to be safe.
Report it to the platform. Amazon, for example, has a process for reporting unsolicited packages, and doing so helps them shut down the fake seller accounts behind these schemes.
Consider a credit freeze or monitoring. If a mystery package shows up, it's a nudge to check whether your information has been part of a larger data breach, and a credit freeze can add a layer of protection while you look into it.

"That sounds like a lot of work. How do I accomplish that?"

It's actually less work than it sounds. Reporting an unsolicited package usually takes a couple of minutes through the retailer's website, and checking your statements is something you can fold into a habit you probably already have. The bigger step is figuring out where your information leaked from. It can take more digging, but plenty of free tools exist to check whether your email or personal details have shown up in a known breach.

"Is there anything else I should watch for?"

Yes, don't use the product you received. Even though brushing scams are mostly about fake reviews rather than direct harm to you, there's no way to verify what you're holding came from a safe source or hasn't been tampered with. It's better to set it aside, document it for your report, and let the platform handle it from there.

Brushing scams are a good reminder that cybersecurity isn't only about hackers breaking into your electronic devices; sometimes it's about how your personal information travels to places you never expected, like a warehouse shipping fake reviews in a box. Staying alert to small, strange signals like an unexpected package can help you catch bigger problems before they grow.

See if your passwords are protecting you.

See how ❯