A brushing scam happens when a seller ships you a package you never ordered so they can post a "verified purchase" review in your name. If you just opened an unexpected delivery, here are the three things to do right now:
- Check your accounts first. Log into Amazon, Walmart, or whichever marketplace matches the package and confirm no order was placed under your account.
- Report it to the marketplace and carrier. Use the platform's unsolicited-package reporting form and, if the package came via USPS, flag it with the United States Postal Inspection Service.
- Treat your personal data as exposed. Change your passwords and watch your credit. An unsolicited package is often a sign your name and address leaked somewhere.
Speed matters here because fake reviews tied to your account can mislead other shoppers, and the longer your data sits unmonitored, the wider the window for follow-on fraud.
Table of Contents
- What is a brushing scam, exactly?
- How brushing campaigns actually work, step by step
- How to tell if the package you received is part of a scheme
- What to do right away if a mystery package shows up
- Where to report a brushing scam in the U.S.
- How to protect your accounts and data after a brushing incident
- Is brushing illegal in the U.S.?
- When an unexpected package might actually be harmless
- Key Takeaways
- Why brushing scams deserve more attention than they get
- Stay ahead of scams with Scruteon's free alerts
- Authoritative U.S. sources for reporting and further reading
What is a brushing scam, exactly?
Brushing is an illegal practice where a third-party seller creates a fake order in your name, ships you an item you never bought, and then posts a glowing "verified purchase" review under your account or a fake account linked to your address. The seller's motive is simple economics: a verified-purchase badge carries far more weight on Amazon or similar platforms than an unverified one, and the cost of mailing a cheap phone case or a pair of earbuds is trivial compared to the sales lift a cluster of five-star reviews can generate.
The Federal Trade Commission and the United States Postal Inspection Service both treat brushing as fraud. Amazon has its own reporting channel for unsolicited packages, and all three are places you should contact when a mystery box lands on your doorstep.
How brushing campaigns actually work, step by step
Understanding the mechanics makes it easier to see why your data is the real target, not you personally.
- AI amplification — Increasingly, the reviews themselves are AI-generated, producing natural-sounding, specific-sounding text that is harder for both consumers and platform algorithms to flag.
The economic incentive is real. Fake-review campaigns can grow product sales shortly after deployment, according to investigative reporting. That return on a $3 shipping label is why coordinated review farms keep scaling up despite platform crackdowns.
Fake-review networks are growing, with platforms removing a large number of policy-violating reviews annually. The arms race between detection and evasion is ongoing, and AI-generated copy has raised the baseline quality of fake reviews, making them harder to spot without looking at behavioral patterns like sudden review bursts.
How to tell if the package you received is part of a scheme
Most brushing packages share a recognizable profile. Run through this checklist:
- No record in your order history. Log in and check. If nothing matches, that is your clearest signal.
- Small, lightweight, low-value item. Think phone charger cables, silicone rings, hair clips, seed packets, or cheap jewelry.
- Generic or minimal packaging. Often a plain poly mailer with a foreign return address or no return address at all.
- Tracking number you never received. The package arrived, but you got no shipping notification because you never placed the order.
- No invoice or receipt inside. Legitimate retailers include packing slips; brushing packages typically do not.
- QR code or short link included. This is a red flag on its own. Scammers sometimes insert QR codes that lead to credential-harvesting sites, a tactic known as quishing.
Common item types used in brushing schemes include Bluetooth earbuds, USB cables, phone cases, small cosmetics, seed packets, and inexpensive jewelry. None of these are valuable enough to explain why someone would pay to ship them to you for free. That gap is the tell.
Receiving an unsolicited package is a strong indicator that your name and address have been exposed in a data breach or sold on illicit lists. The package itself is almost beside the point.
What to do right away if a mystery package shows up
Work through these steps in order. Do not skip ahead to "keep the item and move on."
- Ask friends and family first. Someone may have sent a gift and forgotten to mention it. Rule this out before escalating.
- Do not scan any QR codes or follow any links inside the package. Set the packaging aside. Any QR code or URL included could redirect you to a phishing site designed to steal your login credentials or payment details.
- Check your marketplace account and order history. Log in directly (not via a link in the package) and look for any order you did not place.
- Report to the marketplace and carrier. Use Amazon's unsolicited-package reporting form, or the equivalent on whichever platform the item appears to be from. If it arrived via USPS, you can mark it "Return to Sender" if a return address exists, or report it to the Postal Inspection Service.
- Photograph the package before opening or discarding it. Capture the label, return address, any QR codes, and the item itself. These photos are evidence.
Pro Tip: Never use return instructions printed inside a brushing package. Scammers sometimes include fake "return portals" that collect your account credentials. Always initiate any return or report through the official marketplace website or app, typed directly into your browser.
Reporting quickly helps platforms de-index the fake reviews tied to your address. The sooner the marketplace links that shipment to a fraudulent account, the faster those reviews come down and stop misleading other shoppers.
Where to report a brushing scam in the U.S.
Report to all three channels below, not just one. Each serves a different enforcement function.
- The marketplace (Amazon, Walmart, eBay, etc.). This is your first call. Platforms can pull fake reviews, suspend seller accounts, and flag the address for future monitoring. Amazon's specific form is at amazon.com/gp/help/customer/display.html?nodeId=G33XVXQPUV79Z2ZC.
- United States Postal Inspection Service (USPIS). If the package arrived by mail, file a report at uspis.gov. USPIS investigates mail fraud and can act on patterns across multiple recipients.
- Federal Trade Commission (FTC). File at ReportFraud.ftc.gov. The FTC uses consumer reports to build enforcement cases and can pursue civil penalties against companies that knowingly use fake reviews.
What to include in every report:
| What to provide | Why it matters |
|---|---|
| Photos of the package and label | Confirms physical evidence of the shipment |
| Tracking number | Links the package to a specific seller account |
| Sender name and return address | Helps platforms and investigators trace the source |
| Screenshot of your order history | Proves you did not place the order |
| Item description and photos | Identifies the product category used in the scheme |
| Date and delivery method | Establishes a timeline for enforcement review |
Reporting to the marketplace first matters because platforms have the fastest ability to remove fake reviews and suspend seller accounts. Your FTC and USPIS reports then feed into broader enforcement actions that can result in civil penalties under the FTC's 2024 final rule banning fake reviews.
How to protect your accounts and data after a brushing incident
Treat this as a data-leak response, not just a weird delivery.
Within 24 hours:
- Change the password on any marketplace account associated with your address.
- Enable multi-factor authentication (MFA) on those accounts if you have not already.
- Check your email account for any order confirmations or account-change notifications you did not initiate.
Within the first week:
- Pull your free credit reports from AnnualCreditReport.com and scan for unfamiliar accounts or inquiries.
- Place a fraud alert with one of the three major credit bureaus (Equifax, Experian, or TransUnion). A fraud alert is free and prompts lenders to verify your identity before opening new credit.
- Consider a credit freeze if you believe your Social Security number may also be compromised.
- Monitor your existing bank and credit card statements for small, unfamiliar charges, which sometimes precede larger fraud attempts.
The connection between an unsolicited package and a data leak is direct. Security researchers treat brushing packages as indicators of wider data exposure, which is why the identity-hygiene steps above are not optional extras. They are the actual response.
Is brushing illegal in the U.S.?
Yes. Brushing violates federal law on multiple fronts.
The FTC's 2024 final rule explicitly bans the sale, purchase, and creation of fake reviews, including verified-purchase reviews generated through brushing schemes. Companies that knowingly disseminate fake reviews face civil penalties. The rule strengthens the FTC's enforcement toolkit and signals that consumer reports can directly trigger investigations.
On the merchandise side, U.S. law is clear: unsolicited merchandise is legally considered a gift. You have no obligation to pay for it, return it, or contact the sender. The Wisconsin DATCP guidance, which reflects the federal framework, confirms you may keep, donate, or discard unsolicited items without any legal liability. Do not let any follow-up communication from the "seller" pressure you otherwise.
USPS treats the mailing of unsolicited merchandise as potential mail fraud when it is part of a coordinated scheme, which is why USPIS reports matter beyond just the individual package.
When an unexpected package might actually be harmless
Not every mystery delivery is a brushing scheme. Run through this quick check before you report:
- Ask everyone in your household. Spouses, roommates, and adult children order things and forget to mention it.
- Check your email for retailer promotions. Some brands send free samples or loyalty gifts without advance notice.
- Look for a recent purchase that matches. Subscription boxes, pre-orders, and split shipments sometimes arrive without a clear label.
- Verify the sender address against official retailer domains. A package from "amazon-fulfillment-center-returns.net" is not Amazon.
- Call the retailer's official customer service number (found on their actual website, not on the package) to ask whether they sent a promotional item to your address.
If none of those checks produce a match, treat it as a brushing package and follow the reporting steps above. When in doubt, keep the item (you are legally entitled to it) and report anyway. Reporting costs you nothing and helps platforms catch fraudulent sellers faster.
Key Takeaways
A brushing scam means your personal data is already out there, and reporting it promptly is the single most effective thing you can do to limit the damage to other shoppers and your own accounts.
| Point | Details |
|---|---|
| Report to all three channels | File with the marketplace, USPIS, and FTC to trigger both platform and law enforcement action. |
| You keep the item legally | U.S. law treats unsolicited merchandise as a gift; you owe nothing to the sender. |
| Treat it as a data breach | Change passwords, enable MFA, and check your credit within 24 hours of receiving a brushing package. |
| Never scan package QR codes | QR codes inside unsolicited packages can redirect to phishing sites that steal your credentials. |
| Scruteon tracks these scams | Subscribe to Scruteon's free newsletter for ongoing alerts when new brushing and fake-order schemes emerge. |
Why brushing scams deserve more attention than they get
Most coverage of brushing scams focuses on the package itself, which is the wrong frame. The package is just the receipt. The real story is that someone already has your name, your address, and possibly more, and they decided the cheapest use of that data was mailing you a phone case.
What bothers me about the conventional framing is that it reassures people too quickly. "You can keep the item, no harm done." That is technically true and practically dangerous. The harm is not the package. The harm is that your data is circulating in networks that sell it to the next buyer, who may have a less benign use in mind than boosting a product rating. The brushing operator is almost certainly not the only one who bought your information.
The FTC's 2024 rule is a meaningful step, but enforcement moves slowly. The faster lever is consumer reporting, because platforms can pull fake reviews within days when they receive a credible report with tracking evidence. Every report filed is a direct hit on the economics of the scheme. That is not a small thing.
Stay ahead of scams with Scruteon's free alerts
Brushing schemes evolve quickly, and the tactics that worked last year (plain packages, cheap items) are being layered with QR-code phishing and AI-generated follow-up messages. Staying current is not optional if you shop online regularly.
Scruteon's free scam-prevention newsletter delivers 1–2 alerts per week, translating the latest enforcement news and emerging tactics into plain-language steps you can act on immediately. No technical background needed. If you have already received a suspicious package and want a second opinion on whether it fits a known scheme, the free Scruteon advice service lets you describe what you received and get a direct, personalized response. Visit scruteon.com to sign up for free or submit your question now.
Authoritative U.S. sources for reporting and further reading
Use these official resources to file reports and verify guidance:
- United States Postal Inspection Service (USPIS) — Report unsolicited mail packages and mail fraud; include tracking number, photos, and sender address.
- Federal Trade Commission — ReportFraud.ftc.gov — File consumer fraud reports; include item description, marketplace name, and any account anomalies.
- FTC 2024 Final Rule on Fake Reviews — Read the enforcement framework and understand civil penalty exposure for sellers.
| Agency / Platform | Best contact path | What to attach |
|---|---|---|
| USPIS | uspis.gov online tip form | Tracking number, label photos, sender address |
| FTC | ReportFraud.ftc.gov | Item description, marketplace, account screenshot |
| Amazon | Account Help > Report Unwanted Package | Photos, tracking number, order history screenshot |
| Other marketplaces | Platform's seller-abuse or fraud reporting form | Same as Amazon: photos, tracking, order history |
Reporting to both the marketplace and the FTC or USPIS matters because they operate on different timelines. The marketplace can remove fake reviews within days; federal enforcement builds cases over months that result in penalties and injunctions. Both outcomes serve you and every other shopper.