What Is a Brushing Scam?

Header

Author: Trend Micro

October 4, 2021

This article is from Trend Micro.

Ever wondered if you can trust online reviews on shopping websites? If you’ve done even a little bit of shopping on sites such as Amazon, you’ve almost certainly come across some reviews that seem too good to be true and questioned their legitimacy. And unfortunately, many of the reviews posted online nowadays are not legitimate — and it’s largely due to brushing scams.

What is brushing scam?

A brushing scam (often called an Amazon brushing scam) is used by online sellers to artificially inflate the number of positive reviews they have. Here’s how they work:

1. A person receives a package that they did not order. It is addressed to them, but there is most likely no return address.

2. The person opens the package and either chooses to keep the contents or throw it away. The person can’t return the package because of the lack of a return address.

3. The sender of the package posts a fake review on their online store, pretending to be the person they sent the package to.

The sender of the package does this to make it seem as though there was a verified sale of one of their products. The review they will write of their product will be glowing, and to prospective buyers, it will seem as though the product is excellent when in actual fact, nobody ever legitimately purchased it. The product will most likely be of very little value and cheap to ship, so the sender can afford to pull this tactic off many times and build up a large collection of glittering (but fake) reviews.

Why are brushing scams bad?

On the face of it, brushing scams may seem harmless. You might think “the person didn’t pay for the package, so what’s the problem?”.

One of the problems is the fact that the personal information of the package receiver is almost certainly compromised. Fraudulent online sellers most often obtain people’s names, addresses, and other personal information illegally — often from underground online websites or on the dark web. They will almost certainly use this information to commit other crimes and scams in the future.

Another issue is the fact that due to the seller’s online store having lots of positive reviews, other people will be prompted into making legitimate purchases of what are most likely poor-quality items.

How to protect yourself from brushing scams

Received an unwanted package in the mail? Here’s what to do about it:

1. If you want it, you can keep it. In the US, by law, you are entitled to keep unsolicited merchandise without needing to pay for it.

2. If you’re contacted by the seller and asked to pay for the goods, don’t. Don’t fall for any tricks or intimidation tactics they may use. If they provide you with a pre-paid return label, you can send back the package if you wish.

3. If it is clear which retailer the goods were sent from, contact them and file a fraud report and ask that any fake reviews posted under your name are removed.

4. If you’ve opened the package and you don’t want what’s inside, feel free to throw it away in the trash if it is safe to do so.

5. If the contents of the package are suspicious in any way, contact the relevant authority.

6. Change the passwords to your online accounts. In case more of your personal information has been compromised, it’s better to be safe than sorry.

We all need to do our part

Brushing scams are far more concerning than they first appear. If you are ever the target of a brushing scam, make sure to follow the tips outlined above to protect yourself and others. When everybody plays their part, brushing scams will soon become logistically and financially unviable for the scammers.

Report a Scam!

Have you fallen for a hoax, bought a fake product? Report the site and warn others!

Help & Info

Top Safety Picks

Your Go-To Tools for Online Safety
Disclaimer: Some of the links here are affiliate links. If you click them and make a purchase, we may earn a commission at no extra cost to you.

  1. ScamAdviser App : That site looks legit. That's exactly how they get you. Modern scams are frighteningly convincing. ScamAdviser scans sites and blocks fraud calls automatically. Free on iOS & Android.
  2. NordVPN : NordVPN delivers powerful, seamless protection for your online life - whether you're at home, on public Wi-Fi, or traveling abroad. Recognized as one of the fastest VPN services available, it combines lightning-fast speeds with advanced encryption to keep
  3. Incogni : Incogni automatically removes your personal data from data brokers that trade in personal information online, helping reduce scam and identity theft risks without the hassle of manual opt-outs. Reclaim your privacy now!
  4. Private Internet Access (PIA) : PIA gives you a no-logs VPN built on the latest encryption standards and WireGuard protocol — meaning your browsing activity stays yours alone. Fast, private, and transparent. Take back your privacy today!
  5. Surfshark VPN : One subscription, unlimited devices. Surfshark is the fastest VPN out there — covering your phone, laptop, tablet and more with a stable, secure connection for browsing, streaming and working. Get Surfshark now!
  6. Proton VPN : Independently audited and built with a strict no-logs policy, Proton VPN is trusted by over 3 million users worldwide. It’s been named Best VPN by Wired, PCMag, and Vice—offering strong encryption for anyone who takes their privacy seriously. Give Proton
  7. Mysterium VPN : MysteriumVPN gives you real privacy without relying on a single company to protect it. Built on a decentralized network of independent nodes across the globe, it hides your traffic from ISPs, trackers, and the VPN provider itself. Choose data center IPs f

Popular Stories

In a nutshell: A good VPN protects your privacy with strong encryption, a strict no-logs policy, and fast protocols like WireGuard. The best VPNs also offer wide server coverage, leak protection, and easy-to-use apps for all devices. For 2025, the top providers are NordVPN, ExpressVPN, Surfshark, Proton VPN, Private Internet Access, CyberGhost, and Mullvad—each excelling in speed, security, or value. In an age where every click is tracked, a Virtual Private Network (VPN) is no longer just a luxury—it's an essential tool for digital privacy and security. A VPN works by creating a secure, encrypted tunnel between your device and the internet, masking your real IP address and protecting your sensitive data from prying eyes. But with hundreds of providers out there, how do you sort the secure from the suspect? This guide breaks down the non-negotiable features of a quality VPN and highlights the 7 top-rated services for 2025. What to Look for in a Good VPN: The 4 Non-Negotiable Pillars 1. Ironclad Security Features Strong Encryption: AES-256, the gold standard. Secure Protocols: OpenVPN, WireGuard, NordLynx, Lightway. Avoid PPTP. Kill Switch: Ensures no accidental IP leaks. Leak Protection: Covers DNS, IPv6, and WebRTC. 2. Verified Privacy Practices No-Logs Policy: No activity or metadata tracking. Independent Audits: Verification by third parties. Safe Jurisdiction: Prefer countries outside the 5/9/14 Eyes alliances. 3. High-Speed Performance Fast Protocols: WireGuard and equivalents. Large Server Network: Less crowding, more reliable speeds. 4. Essential Usability Features Multi-Device Apps: Windows, Mac, iOS, Android, routers. Simultaneous Connections: One account, many devices. Unblocking Power: Netflix, Hulu, BBC

This article has been updated by Jamie James on June 9 with the latest data and analysis we have found using real user reports and experiences submitted to ScamAdviser. Just received that terrifying notification? Or perhaps you've noticed suspicious activity in your accounts? Take a deep breath. Your email, password, phone number, home address, payment details, or identity documents may now be in places you cannot control. But the next steps do not have to be confusing. What matters most is how quickly you act, order, and know which exposed data creates the biggest risk. This guide explains what to do after a data breach, how to check the damage, and how to protect yourself from identity theft, account takeover, and follow-up scams. Quick Summary Verify the data breach notice through the company’s official website before clicking any links. Secure your primary email account first because it controls many password resets. Change the exposed password and every reused or similar password. Enable multi-factor authentication on email, banking, payment, cloud, and social accounts. Contact your bank or card issuer if payment or bank account details were exposed. Freeze or protect your credit if sensitive identity information was compromised. Watch for phishing messages, fake refund offers, and scam websites that use your leaked details. Starting with Data Breach Numbers The numbers don't lie: according to a 2024 report, the number of data breach victim notices has grown by a staggering 211% year-over-year. This isn't just a distant threat; it's a stark reality many individuals fa