What to Know About Brushing Scams

With the rise of online shopping, it’s very likely that you’re used to receiving packages at your home. But what happens when you start receiving packages you didn’t order?

Across the country, people are finding themselves in that very situation. Unfortunately, many don’t realize these packages are part of a brushing scam that could leave them vulnerable to con artists. In this article we’ll explain what brushing scams are and how best to protect yourself from them.

What are Brushing Scams?

A brushing scam (or packaging scam) starts when you receive a package full of merchandise you didn’t order and with no return address. Around the country, people have received boxes full of inexpensive items such as:

• Hand warmers
• Flashlights
• Face masks
• Cheap electronics
• Unlabeled seeds

Often, these packages appear to be from major online retailers you might recognize like Amazon, Shein, or Temu. People open these mystery packages because they trust the retailers they come from — recipients may even think they’ve ordered these packages until they see what’s inside. 

At best, packaging scams are a ploy to generate good reviews. The sender is usually an international, third-party seller. They hope having a large number of positive reviews will increase their sales. The merchandise they send for free is a cheap investment they think will pay off in the long run.

Sometimes they will ask you to leave a review in exchange for the free gift. However, more often than asking you to write the review, they will fake their own reviews by:

• Purchasing their own product in your name
• Writing a fake review under your name
• Receiving a verified purchase badge because they bought the product as you

At worst, brushing scams are a clever way to steal identities. Recently, people have been receiving packages containing printed QR codes. These codes may encourage you to scan them to receive information about the product, leave a review, or claim additional products for free. Once scanned, the code sends scammers access to your phone and any personal and financial information on it.

How to Avoid Falling for Brushing Scams

The best way to prevent brushing scams is to protect your personal data. Limit your online presence by deleting unused accounts and setting your social media accounts to private. You can also request that personal information like your birthday, address, phone number, and email address be removed from public online databases.

Even if you take steps to protect your personal information, it’s likely that some of your information will (or has been) leaked through security breaches involving major companies you do business with. In 2024 alone, there have been:

• 2.7 billion personal records leaked in the National Public Data breach
• 560 million personal records leaked in the Ticketmaster breach
• 145 million records leaked in the Change Healthcare breach

Your best bet in situations like these is to take advantage of any free security monitoring that companies offer as a settlement. You should also take standard steps to protect your personal data online, including:

• Reviewing your credit report regularly, and possibly freezing your credit
• Using a password manager to create strong passwords
• Enabling multi-factor authentication
• Securing your home computer, smartphones, and tablets, and keeping them updated so they have the most recent security patches
• Limiting your online presence and using privacy controls on social media
• Avoiding public Wi-Fi — opt for your phone’s hotspot instead
• Using antivirus software and a firewall on your home computer
• Using a VPN

What Do I Do if I Am the Victim of a Brushing Scam?

It’s scary to realize you’re involved in a scam, especially one that feels as confusing as brushing. Thankfully, you can protect yourself from this and many other cons by taking steps to protect your personal data and your online presence.

Steps for Protecting Your Personal Data

The Better Business Bureau has published steps consumers can take to protect themselves from brushing scams:

1. Do not send anyone money. You are not obligated to pay for merchandise you did not order. Likewise, do not scan anything or visit any websites mentioned on or inside the packaging.
2. Notify the retailer. Let them know you’re receiving items you didn’t order and give them whatever information is available, including a return address, company name, tracking number, and list of items in the package. (Some of this information may not be available. Just provide what you can.) Amazon has a dedicated page for handling brushing scams.
3. Request fake reviews be removed. If you can identify the seller who sent you packages, make sure they aren’t using your name to sell their products.
4. Check your account. Make sure you haven’t been charged for items you didn’t order. If you’re receiving lots of packages, you can temporarily refuse package delivery to your house.
5. Review your online data. Change your account passwords, review your credit card and bank statements, and consider freezing your credit.

Should I Worry if I Didn’t Click or Scan Anything?

Brushing scams can only happen if scammers can find your personal information online. This means that if you are receiving unordered packages in the mail, it’s possible that your name, address, and phone number have been leaked online. It’s possible other data has been leaked as well, which could put you at greater risk of identity theft.

What Should I Do With Items I Receive from Brushing Scams?

You should not pay for unordered items that are sent to you. If they have a return address, you can write “return to sender” on the packaging and return the item for free — but you don’t have to. You are free to keep, donate, or gift any items you receive through a packaging scam.

That being said, do not plant any seeds you receive from brushing scams, as they may be invasive species. The safest action is to report foreign seeds or plants to your state’s Department of Agriculture or Department of Fish and Wildlife. You can also contact the National Invasive Species Council for advice.

The Takeaway

It may feel like you hear about a new scam every time you turn around, but that doesn’t mean you’re helpless. Adopting consistent security habits can protect you from most of the threats that are out there.