If you ever get a mysterious package and can’t figure out why, it’s possible you’re a victim of a brushing scam.
A scammer got your name and address, sent you a real package, and will use that information to file a 5-star review somewhere. Sometimes, the package will include a QR code that, if you scan and visit, will try to get you to install malware or enter in personal details “to find out more.”
Brushing scams have evolved over the years. They used to do it for reviews, now they have broadened it to include trying stolen credit cards, delivering QR codes, test stolen accounts, etc.
Here’s what you should do in response:
Table of Contents
What is a Brushing Scam?
Brushing scams are when a scammer sends you a mysterious package.
There are two directions this scam can go:
- 5-Star Review Boosting Scams: A scammer created a fake profile for you on a merchant’s website (Amazon, Wal-Mart). They ordered a product, had it sent to you, and will leave a 5-Star review afterwards. It’s a “Verified Purchase,” which is valued more. This boosts the average review score of the product.
- QR Code Scams: A scammer sends you a package with a QR code on it. You, in trying to figure out who sent this gift, might be tempted to scan the QR code. It leads to a website aimed at tricking you into giving up personal information or financial details.
There are dangerous variations on these two themes. If you accidentally provide information, they may demand you return the items by shipping them back (according to FTC rules, unordered products are considered gifts). They may give you a fake UPS or FedEx website to entice you to give up more financial information to pay for shipping.
What Should You Do?
Discard or Donate the Item
If you don’t want the item, you can discard or donate it. Federal law says that unsolicited merchandise is generally considered a gift. You don’t have to pay for it and you don’t have to return it.
If you want to keep it, you can. If you don’t, it’s yours to do as you wish.
Never Scan a QR Code
You may be tempted to “find out” who sent this to you… but don’t ever scan a QR code. That will almost always send you to a site that will try to convince you to download malware or enter in your personal information. You will not find out more, you will only tell them more.
Report to Authorities
If you can find out what marketplace “sold” you the item, try to reach out and report it to them. Amazon has a brushing report page as does Wal-mart.
You can also report it to the carrier that delivered it:
If a QR code is involved, you will want to report it to the Internet Crime Complaint Center.
Delete Your Information
Your information is floating out there at hundreds of data brokers. Our guide explains how to delete your data from data brokers, which you can do over a few hours spread across a few weekends.
Or you can pay a service like Incogni or DeleteMe to remove it on your behalf. The benefit of using a service is that they will do continuous monitoring and request deletions if your information re-appears (which happens quite often).
The big difference between the two is that Incogni is cheaper ($8/mo) and uses automation to remove your data while DeleteMe is slightly more expensive ($10.75/mo) and does it manually with human-verified removals. Both are effective though.
I would also use Google’s Results About You tool to delete your name and personal information from Google’s Search Results. It doesn’t delete the data from the data brokers but it makes it unsearchable, which is half the battle.
Check Your Shopping Accounts
If the package came from Amazon or Wal-mart or Temu or whatever, check those accounts. Log in directly (don’t scan a QR code!) and look for any orders you didn’t place, new payment methods or shipping address, and any hidden or archived orders.
It’s rare that someone got access to your account and decided to initiate a brushing scam, but it’s possible.
If you see anything weird, change your password and turn on two factor authentication.
Review Your Credit
Your name and address were probably obtained from a data breach, public records, or a data broker. Since mailing addresses are widely available, receiving a brushing package doesn’t necessarily mean criminals have your Social Security number or financial accounts. It does mean your information is circulating, so it’s worth being extra cautious.
It’s important to review your credit reports to see if there’s any strange activity. While you’re at it, keep an eye on your credit card statements too (or turn on transaction notifications to see if there are any small test charges).
Finally, start taking some of these steps to protect your identity (like freezing your credit!).
Not Every Unexpected Package is a Scam
Sometimes you really did get a gift… so it’s important not to overreact. Sometimes a merchant will accidentally send multiple items or it’s a replacement you forgot was coming.
And ultimately, most brushing scams don’t directly steal money. Their goal is usually fake reviews, confirming your address, or getting you to interact with a malicious QR code or website.
As long as you don’t scan anything, enter personal information, or send money, you’re unlikely to suffer any immediate harm. Use it as a reminder to review your online accounts and tighten your identity protection.
