Brushing / Unordered-Package & Review Hijack
You receive packages you didn't order (a 'brushing' scam) — a sign a seller is using your info to post fake reviews, and possibly that your data is exposed.
Think a message like this reached you? You can check it right now.
What this scam is
In a brushing scam, third-party sellers send you cheap items you never ordered so they can mark you as a 'verified buyer' and post fake positive reviews in your name to boost their products. While the free item is harmless, it means someone has your name and address (and possibly more), and your account details may be compromised or your data is circulating. A QR code included in such packages may lead to phishing. Checking your accounts and watching for misuse are the right responses.
What it usually looks like
- Packages arriving that you didn't order.
- Cheap items from third-party sellers.
- Later, fake reviews posted under your name.
- Sometimes a QR code or note in the package.
Common warning signs
- Unordered packages addressed to you.
- Reviews in your name you didn't write.
- QR codes/notes urging you to scan or respond.
- Signs your account or data may be exposed.
Example wording scammers use
“(No message — just an unexpected package.)”
“(Included card) 'Scan this QR to claim your free gift / leave a review.'”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- To post fake 'verified' reviews in your name.
- To exploit or test your exposed data.
- Possibly to phish you via an included QR.
What to do
- You can keep unordered items (you're not obligated to pay), but check your accounts for unauthorized activity.
- Change passwords and enable 2FA on your shopping accounts; report fake reviews to the marketplace.
- Don't scan QR codes included in mystery packages.
- Consider that your data may be circulating; stay alert to related scams.
What to do if you already responded
- If you scanned a QR/entered info, change passwords and watch for phishing.
- Report the brushing to the marketplace (e.g., Amazon) and USPS if relevant.
- Report at reportfraud.ftc.gov.