Last month, the FTC Consumer Advice raised the alarm about a new type of scam gaining popularity in the USA. This fraudulent activity, called a brushing scam, involves fraudsters sending packages to unsuspecting recipients from large online retailers such as Amazon or Walmart. Once the product reaches a real person at a real address, the fraudster leaves a fake review on the website. The platform then marks it as a “verified review.” AI agents may quote these reviews to potential buyers, tricking both people and LLMs into believing they are authentic. The packages often contain cheap products that fraudsters are willing to lose in lose for a positive review, such as toothpicks, socks, or other items.
Key takeaways
- Brushing scams involve unsolicited packages used to create fake “verified” reviews.
- While most scammers use this method to boost their own products with 5-star ratings, they can also use it to post damaging 1-star reviews against competitors.
- An unexpected package is a red flag that someone may have exposed your personal data.
- The FTC Advice states that recipients don’t have to return the unwanted package, but recipients should report it and stay vigilant.
Why are reviews marked as verified if they are delivered to a random address?
Online retailers will likely have to fix that sooner or later, but for now, reviews are marked as verified if delivery is validated, meaning sellers can prove they successfully delivered a product. Sellers can’t know whether an address is fake or whether the person who purchased the item is a fraudster or an unethical marketer. On the seller’s part, they only see that the payment has cleared and that the item was delivered to the address on file. However, the increase in brushing scams means that more sellers or marketing agents with questionable ethics are taking advantage of the loophole.
Do fraudsters only leave positive reviews when running brushing scams?
Not really. Fraudsters don’t only generate fake positive reviews to boost sales. They also use this tactic to post negative reviews about competing products. Most fraudsters use brushing to create fake positive reviews, but some use the same method to post damaging 1-star reviews against competitors. The seller may have successfully sold the product, but a fake negative review can haunt the business forever, especially when it comes from someone who never wanted or purchased the item.
How do scammers know where to send the products?
Public databases exist that list real people’s names, addresses, emails, and phone numbers. After so many data breaches, huge amounts of data still float around the dark web too. Scammers often use public lists, purchase lists from data brokers, or obtain lists from the far and dark corners of the internet. They use these lists not only to push brushing scams but also to run phishing attempts and commit identity theft.
Sometimes an unwanted package that appears to be a brushing scam may look like it’s from Amazon, but in reality, it could be a phishing attempt. The label on the outside of the box or the paperwork inside may include a QR code or phone number. These often claim to help the recipient contact the sender about a order mistake. In reality, scanning the code or calling the number can lead to a malicious site or a live operator trying to extract personal or financial information.
What to do if you receive an unexpected package on your porch?
The FTC Consumer Advice team encourages people receiving unexpected packages to report them to ReportFraud.ftc.gov. Authorities are aware of these scams, and by reporting suspicious packages, people point law enforcement in the right direction. The FTC also reminded people that they do not need to return products they did not order, so discarding them and/or reporting them to local law enforcement or directly to the FTC is usually enough to help authorities try to find the fraudsters and hold them accountable.
While brushing scams may not seem dangerous and can look like free stuff, the items in the package come from an unknown origin. They may contain inaccurate or malicious links, pose health risks, or signal that scammers are targeting you. Receiving one also suggests your personal details are circulating and available to cybercriminals. Stay vigilant: do your own research, monitor your credit reports regularly, and use reliable antivirus software. Fake reviews have existed for a long time and can mislead anyone — human or AI — who relies on them. Taking these simple steps helps ensure you only read about these scams instead of experiencing them.
