What is a brushing scam?
A brushing scam is a fake-review scheme in which a seller sends merchandise to someone who did not order it, then uses that person’s name to post positive reviews. The FTC’s August 2026 consumer alert describes packages that often look as if they come from a known company such as Amazon and usually hold something cheap: baby wipes, toothpaste, seeds.
The FBI uses the same definition in its July 2025 public service announcement on unsolicited packages containing QR codes, and the US Postal Inspection Service notes that the sender is often an international third-party seller (USPIS).
The name comes from “brushing up” sales numbers. The package is not the product being sold to you; it is a prop that makes a fake transaction look real.
Why do sellers send packages you didn’t order?
Because a review attached to a real delivery is worth more than a review from nowhere. On large marketplaces, the number of orders and reviews pushes a product up the search results. A seller who creates accounts in other people’s names, ships them cheap items and then reviews them gets two things: a delivery record that looks genuine, and a stream of five-star ratings.
- The delivery is the evidence. The FTC says scammers want “validation” of delivery before posting the review.
- Your address is the raw material. It may come from a data breach, a public directory or an old order.
- The cost is low. A light, cheap item shipped in bulk costs less than many paid advertising clicks.
Fake reviews are illegal in the US. The FTC’s final rule announced on 14 August 2024 bans creating, selling or buying fake reviews and testimonials, including AI-generated ones, and allows civil penalties for knowing violations. To learn to read reviews critically, see how to spot AI-generated reviews.
Is a brushing scam dangerous?
The item is rarely dangerous; what it reveals can be. Three risks are worth taking seriously.
| Risk | Why | What to do |
|---|---|---|
| Your data is circulating | Someone has your name and address, sometimes your phone number | Change marketplace passwords, watch your credit report |
| An account in your name | The review may be posted from an account opened with your details | Ask the marketplace to check and remove it |
| A QR code in the box | It can lead to a site that asks for personal or payment data, or installs malware | Do not scan it |
| Seeds, plants, food or liquids | Unknown organic material or substances | Notify the authorities and follow their instructions |
The QR code version is the one to watch. The FTC alert describes a note claiming that scanning it will reveal the sender or process a return; the FBI warns that such codes can lead to sites that ask for personal and financial information or install malware.
Can you keep a package you didn’t order?
Yes, in the US. The FTC says the law does not require you to return things you did not order, and you do not have to pay for them either. It adds a sensible caution: be careful about using the product, since you do not know who sent it.
USPIS gives the practical options (USPIS brushing scam page):
- If the package is unopened and has a return address, mark it “Return to sender” and the Postal Service returns it at no charge.
- If you opened it and do not want it, you can throw it away, as long as that is safe.
- If you opened it and like it, you can keep it: you have no obligation to pay for unsolicited merchandise.
Before deciding it is brushing, rule out the boring explanations: a gift from someone who forgot to tell you, a subscription you signed up for, or an order placed by someone in your household. Amazon’s help page on unsolicited packages suggests checking with friends and family first.
What to do if you receive a brushing package
- 01Do not pay anything linked to the package, and do not call a number printed inside it.
- 02Do not scan any QR code included with it.
- 03Change the passwords of your online shopping accounts and turn on two-step verification, as the FTC and USPIS both advise.
- 04Tell the marketplace. If the package came through Amazon or another marketplace, report it so the platform can investigate and remove the seller. Amazon has a report form for unwanted packages and says third-party sellers are prohibited from sending unsolicited packages.
- 05Ask for fake reviews to be removed. USPIS suggests asking the retailer to remove reviews posted in your name.
- 06Check your credit. The FTC points to AnnualCreditReport.com to look for signs of identity theft; the FBI mentions free reports from Equifax, Experian and TransUnion.
- 07Report it. Tell the FTC at ReportFraud.ftc.gov; if you scanned a QR code or shared data, also report to the FBI at ic3.gov with the details of what you did.
Brushing or something else? Package mix-ups compared
An unexpected parcel is not always brushing, and the right reaction depends on which case you are in. Look at who it is addressed to, whether it is linked to an account of yours, and whether anyone asks you to do something with it.
| Case | Typical signs | What to do |
|---|---|---|
| Brushing | Your name and address, cheap item, no invoice, sometimes no sender | Keep or return unopened; secure accounts; tell the marketplace |
| Gift or household order | A gift note, or an order in a family member’s account | Ask around before anything else |
| Wrong address | Someone else’s name on the label | Contact the carrier or the marketplace’s customer service |
| Order from your account | The order appears in your own order history and you were charged | Change your password, contact the marketplace and your card issuer: this is account takeover, not brushing |
| “Job” parcels | An employer asked you to receive and forward packages | Stop: it is a reshipping scam |
| QR code or “scan to claim” | A card inviting you to scan to see the sender or claim a prize | Do not scan; report it |
The fourth case is the one people miss. If the order shows up in your own account and you paid for it, someone has your login, and the urgent step is securing the account and disputing the charge.
How brushing shows up in the reviews you read
Brushing is aimed at shoppers, not at you. The point of the parcel is a review that looks like it comes from a real buyer, so the damage lands on whoever trusts those reviews. A few patterns suggest a product’s rating has been brushed:
- A burst of five-star “verified purchase” reviews within a few days, for a product with little history.
- Short, generic praise that could describe any product (“great quality, fast shipping”), repeated with small variations.
- Reviewer profiles that rate dozens of unrelated cheap items, all with five stars.
- Photos in the reviews that look like the seller’s own product shots rather than pictures taken at home.
None of these signs is proof on its own, and marketplaces run their own detection. Read the recent critical reviews, which brushing does not produce, and see how to spot AI-generated reviews for the text patterns of generated praise.
Can you find out who sent it?
Usually not with certainty. The label may show a marketplace fulfilment address, a generic return address abroad or nothing at all; the FBI notes that packages often arrive with no sender information precisely to push you toward the QR code. The marketplace can link the shipment to a seller account; you cannot.
If the package or its insert names a website, check it before you visit it on a phone: look up the domain’s age, the company in its legal notice and its Safe Browsing status, as described in how to check if a website is legit. Our Business Check does those checks in one report and says plainly what it could not verify.
Business Check · Free preview
A website is printed in the package? Check the business behind it before you open it on your phone.
Brushing outside the US
The same scheme reaches buyers wherever large marketplaces deliver, and the advice carries over: do not pay, do not scan, secure your accounts and tell the marketplace. Consumer rights on unsolicited goods differ by country, so check your national consumer authority before disposing of anything of value. In the UK and France, the reporting channels in how to report a scam apply if you shared data or lost money.
Frequently asked questions
Is a brushing scam illegal?
Posting fake reviews is. The FTC’s rule announced in August 2024 bans creating, buying or selling fake reviews and allows civil penalties against companies that knowingly break it. Marketplaces such as Amazon also prohibit sellers from sending unsolicited packages and can remove them.
Do I have to pay for or return a package I didn’t order?
Not in the US. The FTC says you do not need to return items you did not order and do not have to pay for them. USPIS adds that an unopened package with a return address can be marked “Return to sender” at no charge.
Does a brushing package mean my account was hacked?
Not necessarily. Sellers need only a name and an address, which can come from a breach or a public source. Still, change your marketplace password, turn on two-step verification and check your order history for purchases you did not make.
Should I scan the QR code that came with the package?
No. The FBI’s July 2025 warning describes QR codes in unsolicited packages that lead to sites asking for personal and financial information or that install malware. If you already scanned one, secure your accounts and report it at ic3.gov.
What if the package contains seeds or plants?
Do not plant or open them further. The US Postal Inspection Service says to notify the authorities when an unsolicited item is organic, such as seeds, food or plants, or an unknown liquid or substance, and to follow their instructions.
Can I get fake reviews in my name removed?
Yes, ask the marketplace. USPIS recommends notifying the retailer, filing a fraud report and asking it to remove reviews posted under your name. Amazon’s help page on unsolicited packages has a report form for unwanted packages.