What is a brushing scam, how does it work, and how can you recognize it?

What is a brushing scam?

A brushing scam is an e-commerce fraud tactic that involves sellers sending cheap goods (for example, fake jewelry, low-quality electronics, and similar trinkets) to people without their knowledge or consent. Scammers list inferior products on different e-commerce platforms, buy the listed products using fake accounts, and send them to unsuspecting people. Once the package reaches its destination — typically an address obtained illegally — the fraudulent retailer posts a fake positive review to artificially boost the product’s legitimacy and popularity.

The term “brushing scam” draws its origin from Chinese e-commerce practices. In China, the term “brushing up” refers to a process where product sales are inflated artificially by creating fake orders and sending goods to made-up or random addresses. Using this method, third-party sellers increase products’ demand and trick users into buying seemingly popular and trustworthy goods.

The reason why scammers send their targets unsolicited packages is because of something called a verified purchase review system. Upon delivery, most online retailers issue badges or labels such as “Verified purchase” or similar as a confirmation that the buyer has received the package. This label is also visible when a user posts a product review, supposedly as a means to give it more credibility and reduce fake or biased feedback. However, brushing scammers exploit these labels to write glowing reviews, manipulating unsuspecting shoppers into buying low-quality products. 

How a brushing scam works

A brushing scam works in steps, primarily:

1. Searching for personal information. Scammers browse the dark web for data breaches or use people search and data broker sites to find information such as people’s names and addresses. 
2. Using stolen information to open buyer accounts. Upon collecting enough stolen data, fraudsters open (or seed) hundreds of buyer accounts on online stores or other vendor sites. 
3. “Buying” the goods. Scammers list their goods on e-commerce platforms, buy them, and use stolen addresses (both email and physical) to send the packages to unsuspecting people. Once the parcel reaches the victim, it gains verification (“delivered”) status from the retailers.
4. Writing a fake product review. While the victim of the scam is scratching their head, wondering why there’s a random delivery at their doorstep, a scammer writes a positive review of the delivered product, exaggerating its benefits and features. Since the scammers have bought and sent the item to random addresses, their review gets a “verified purchase” label, creating an illusion that the review is credible.
5. Repeating the process. Fraudsters run the same scheme again, artificially inflating the popularity of low quality products and scamming unsuspecting consumers.

Individuals might sometimes get unsolicited packages with a QR code, too. These are a part of what’s called QR code brushing scams. QR brushing scams work the same as regular brushing, but with a small exception — a QR code sticker on the package. On these stickers scammers may write text that entices users to scan the QR code (for example, calls to action like “scan and see who sent you this gift”)[2]. In reality, however, these QR codes will likely lead users to phishing websites, where they can be tricked into providing their credentials (primarily email addresses and passwords).

Why are brushing scams dangerous?

Brushing scams are dangerous because they pose at least several cyber risks. Some of them are serious enough to lead to broader fraud, such as phishing attacks. The primary threats of a brushing scam are:

• Privacy concerns. Unsolicited parcels are a serious privacy violation that indicates malicious actors might know more than just your physical address. It could also be a sign that your other sensitive data (for example, email address or mobile phone number) are compromised too.
• Account suspension. If scammers used your email address or seeded your online shopping account for a brushing scam, your account might get flagged and suspended.
• Reputational damage. If customers see through the fraudulent product review, they can report it to the platform the review was posted on. That would flag the owner of the account (legitimate person whose account was exploited for a brushing scam) for unusual activity, potentially causing their account to be temporarily suspended and reducing their trustworthiness. 
• Identity theft. As mentioned, brushing scams are a sign that scammers may know more than just the victim's physical address. It could mean that more of your personally identifiable information (PII), such as your email address or mobile phone number is circulating online. If that’s the case, scammers can try and steal your identity through phishing emails or fraudulent calls.
• Financial loss. If they know your email address, bad actors can use it to launch phishing attacks, hijack your accounts, and take out loans or complete big purchases in your name. Scammers could also use QR codes on packages to lead unsuspecting users to phishing sites, stealing email addresses, passwords, or even Social Security numbers.
• Harmful or defective products. Brushing scammers typically try to promote poor quality products, which are cheap and often unpopular. These products may often arrive damaged or faulty, rendering them useless, or in some cases, even harmful (for example, if the parcel contains poorly set up electronics or cheap batteries prone to self-combustion).

How brushing scams affect various platforms 

Unlike most Facebook marketplace scams or Etsy scams, brushing scams are not focused on one particular online vendor or retailer. Scammers may choose to target platforms such as Amazon, Walmart, and Temu, which host millions of users eager to buy or sell various items. These platforms typically measure the seller’s (and product’s) credibility by implementing a user review system. Naturally, such design prompts those looking for a quick buck to artificially inflate the feedback and popularity of low-quality products. 

Since online marketplaces vary in their inventory, order management, and product review systems, brushing scams may work differently depending on the platform. Here’s how brushing scams work on online retailers such as Amazon, Walmart, or Temu.

Amazon brushing scam 

Amazon brushing scams follow the typical brushing scam scenario. Scammers list inferior products for sale, create fake buyer accounts, place low-cost orders to spoofed or made-up addresses, get confirmation on product’s delivery, and then post glowing reviews to boost ranking and search placement. 

Fraudsters typically use the cheapest shipment option that provides a valid tracking ID and gets a “Verified purchase” label. Since scammers send the products by themselves, sometimes the packages may include a QR code or URL that redirects to a phishing page as means to steal login credentials or payment details.

The impact of “verified purchase” reviews on Amazon make this platform a popular hunting ground for brushing scammers. As a countermeasure, Amazon heavily relies on user reports, claiming to investigate every reported case of brushing, flagging potential scam attempts, delisting fraudulent products, deleting suspicious accounts, and, in some cases, even going as far as pursuing lawsuits (as stated in its anti-manipulation policy[3]). 

If you receive a package from Amazon that you’re certain you (or your family or friends) haven’t ordered, report a potential brushing scam attempt on Amazon’s “Report unwanted package” page or contact customer support. Additionally, secure your Amazon account (for example, change your password). 

Receiving an unwanted package suggests scammers may also know your email address or phone number, so make sure to keep an eye out for phishing emails or scam calls.

Walmart Marketplace brushing scam

A Walmart Marketplace brushing scam is the same as any other other brushing scam. Scammers may use Walmart Marketplace (a platform for third-party sellers) to list cheap inferior products, buy them, and then send to unsuspecting “customers.” Upon delivery, the scammer’s account receives a “verified purchase” (or similar) confirmation, which is also visible in the review section, once the review is posted. Scammers then dish out a 5-star rating, artificially boosting the product’s popularity and tricking future buyers into believing that the review is genuine.

In rare cases, scammers might use stolen credit card information to buy Walmart gift cards and use them to buy low-cost goods, saving some of their own money in the process. Additionally, fraudsters may put a malicious QR code on the parcel, hoping to lead unsuspecting users to a phishing site.

If you suspect you might be a target of Walmart brushing scam, contact Walmart’s customer support at (800) 925-6278 or fill in the "Report seller" form on Walmart’s website. Consider changing your Walmart account password, too.

Temu brushing scam

A Temu brushing scam is yet another type of a brushing scam in which users get unsolicited packages. Like with Amazon, fraudsters can set up their seller accounts, in Temu’s case — by using the platform’s sellers’ page. Once they do that, scammers can buy cheap goods (such as plastic cups or other junk) from themselves and send them to spoofed addresses. After receiving delivery confirmation, these "entrepreneurs" write fake reviews to artificially boost the product’s popularity. Some packages may also have a QR code that leads to a phishing site designed to steal login credentials or insert malicious software into the target’s device.

Upon receiving an unexpected package from Temu, first make sure it isn’t a surprise gift from someone you know. Once you’ve ruled that out, contact Temu’s customer support and inform the company about a potential brushing scam. Change your Temu account password, and monitor your email inbox for potential phishing emails, since scammers might also know your email address or phone number. 

eBay brushing scam

eBay, like other e-commerce sites, is also a popular hunting ground among brushing scammers. eBay brushing scams work the same way as they do on other platforms, with scammers sending unsolicited packages to inflate products’ popularity. Fraudsters list the product on eBay, buy it themselves, and ship it to addresses they’ve spoofed from leaked databases. Once they get a confirmation of a completed delivery, they can then post a product review, artificially inflating its benefits. Since a completed delivery grants a “verified purchase” label (visible in the review), it might make potential buyers believe the product is truly as good as the fake review claims it to be.

If you receive a package from an eBay seller that you didn’t order and suspect a brushing scam, contact eBay’s customer support. You can do so via your eBay account or by sending a private message to eBay’s Facebook or X accounts. 

How to recognize a brushing scam 

Recognizing a brushing scam is fairly simple. The main red flag for this scam is usually unexpected packages on your doorstep. Other warning signs that indicate a brushing scam include: 

• A missing invoice. If the parcel arrives with a return address or official invoice or looks vague and foreign, it’s likely a part of a brushing scam.
• An unexpected QR code. Sometimes the packages may come with a QR code or with a link for a “gift,” “warranty,” or “survey.” Do not scan the QR code or type in the link unless you’re certain the package came from someone you know. 
• No recent purchases that would warrant a delivery. If you cannot connect the delivery to a legitimate purchase you made, there's a high chance that you’ve become the target of a brushing scam. Before making such a conclusion, though, make sure to double-check with friends and family to make sure they haven’t sent you an unexpected gift (just in case someone decided to surprise you). 
• Low-cost, poor-quality goods. If upon opening the unsolicited package you find items that look unusually cheap, counterfeit, or mismatched with your interests, you’ve likely been targeted in a brushing scam. 
• Repeated unsolicited deliveries. Unsolicited packages reappear at your doorstep for days or weeks, sometimes from different senders. 
• Online reviews that you didn’t write. Although it may be rare, scammers may hijack your e-commerce account to post fake reviews or feedback tied to your name. If you notice a product review that you did not write, immediately change the password of your e-commerce account.

What to do if you’re a victim of a brushing scam

If you’ve become a victim of a brushing scam, you can pick one of two ways to deal with the situation. First, you can do nothing, ignore the unsolicited package, and carry on with your life (less recommended because it leaves you exposed to future scams). Or you can take action to secure your online data and, hopefully, prevent future brushing scams and further exploitation of your personal information. If you received an unexpected package and suspect a brushing scam:

1. Do not open the package or scan any attached QR codes.
2. Check the package for a return address, tracking number, or any type of receipt.
3. Check with friends and family to rule out a surprise gift.
4. Report the delivery to the platform it came from.
5. Change your password on the e-commerce platform that you’ve received the parcel from to limit the risk of account hijacking.
6. Monitor your financial statements and bank accounts for suspicious transactions.
7. Report the potential brushing scam to local authorities (optional).

How to protect yourself from brushing scams

It doesn’t take much to protect yourself from brushing scams. The most important practices include safeguarding your accounts with strong passwords and 2-factor authentication (2FA), staying informed about the latest scam trends, and making sure you’re ordering goods from reputable sellers. These alone are great first steps that can help protect your personal information online.

Additionally, it’s good to invest in extra safety measures, such as identity theft protection services. While brushing scams are less likely to result in identity theft, the risk still exists. When it comes to identity theft protection services, NordProtect is a solid choice that covers a vast range of benefits.  

With NordProtect, you’ll get instant alerts of sensitive data leaks, credit monitoring services, malware breach alerts, and cyber insurance that will cover up to $1M in identity theft recovery. Alongside these features, NordProtect customers receive cyber extortion protection and 24/7 dark web monitoring — a feature that scans the dark web for your personal data and provides assistance in case of exposure (particularly relevant to the brushing scam victims). It’s a well-rounded service that provides both advanced security and a helping hand, limiting the damage users may suffer when exposed to cyber threats.

Resources

[1] K. Jones, “USPS warning customers of ‘brushing’ scams,” FOX 13 Tampa Bay, Jun. 13, 2025. [Online]. Available: https://www.fox13news.com/news/usps-warning-customers-brushing-scams 

[2] The United States Federal Trade Commission, “Scam alert: QR code on an unexpected package,” FTC Consumer Advice, Jan. 23, 2025. [Online]. Available: https://consumer.ftc.gov/consumer-alerts/2025/01/scam-alert-qr-code-unexpected-package 

[3] Amazon, “Anti-Manipulation Policy for Customer Reviews - Amazon Customer Service.” [Online]. Available: https://www.amazon.com/gp/help/customer/display.html?nodeId=G8CXDFT9GLRRSV3G