What Are Brushing Scams? Why Free Packages Are a Red Flag

A 28-year-old woman refused to celebrate the “free” package on her doorstep. It looked like a harmless win, a few pairs of cheap socks, no charge, no effort. Then she noticed the return label, the timing, and the fact that she never clicked “buy” on anything that week.

That’s the annoying part of brushing scams, they do not steal your money, they steal your identity for a minute. A third-party seller uses your real name and address to create a fake buyer account, orders their own product, and waits for delivery confirmation. Once the tracking says it arrived, that account can post a verified purchase review, and the listing climbs while you sit there wondering why your name keeps showing up in someone else’s sales pitch.

Here’s the part that really sticks, free stuff is the bait, and your address is the hook.

What Is a Brushing Scam?

A brushing scam is when an online seller ships you something you never ordered so they can post a fake "verified purchase" review under your name. The brushing scam meaning traces to e-commerce slang for "brushing up" a product's ratings.

Here is the mechanics, since how brushing scams work is the part that makes it click. A seller, often a third-party vendor on a marketplace like Amazon, AliExpress, or Temu, creates a fake buyer account using your real name and address. They order their own product and ship it to you for free. Once the delivery is confirmed, that account is now a "verified" buyer, so the glowing review it posts carries extra weight. The product climbs the rankings. More real people buy it.

You are not the customer. You are the prop. The seller does not care whether you ever open the box, because the delivery confirmation is the only thing they actually wanted from you.

magnific

That “free socks” moment is where the whole thing starts to feel less like a gift and more like a setup for a fake verified review.

How Do Brushing Scams Work to Get Your Address?

The seller needs a real name and a real address to make the fake purchase look legitimate. They get yours the same way most personal data circulates: a data breach, a leaked database, scraped public records, or a purchase off the dark web.

The United States Postal Inspection Service describes the pattern plainly: parcels you did not request, addressed to you, with no return address or a retailer's address instead. The sender is usually an overseas third-party seller who found your details online.

That is the real takeaway. The free socks are harmless. The fact that a stranger could ship them to you is not.

Are Brushing Scams Dangerous?

Not in the way a stolen credit card is. Nobody is charging you for the package, and you are not on the hook for it. But "harmless free gift" is the wrong read.

A few reasons brushing scams matter:

• Your data is exposed. A mystery package confirms your name and address are in a database someone is using. That same record may include more than you would like.
• There are worse scams behind it. Brushing is on the gentle end of a spectrum that runs all the way to online cons that drain people of tens of thousands of dollars. The exposed data does not stay with the brusher.
• The QR code twist. Newer brushing packages sometimes include a QR code that says "scan to claim a reward" or "track your shipment." Scanning it can route you to a phishing site built to steal your information or payment details. Do not scan it.

So the package itself will not hurt you. What it signals, and what it might escalate into, can.

magnific

When she saw the parcel arrive with the sender details that did not match any order she placed, the scam stopped being theoretical.

This is similar to the neighbor who got fuming over expired treats instead of homemade goodies at a town event.

The real problem hits next, because the seller needed her real name and address, which means those details came from somewhere messy, like a leaked database or scraped records.

What to Do If You Receive One

First, the good news. Under US law, anything mailed to you that you did not order is considered an unsolicited gift, and the FTC says you can legally keep it. You owe nobody postage. If a "seller" claims you do, that is a separate scam.

Then take a few steps that actually protect you:

• Report it. File with the FTC at ReportFraud.ftc.gov and tell the marketplace the package came from. Amazon, eBay, Temu, and Walmart all have forms to report unwanted packages and fake reviews.
• Change your passwords, especially on shopping accounts, and turn on two-factor authentication.
• Check your accounts for orders or activity you did not make.
• Consider a fraud alert on your credit if you suspect wider exposure.

Reporting does more than the satisfying-but-pointless route of messing with the scammers yourself. It feeds marketplaces and regulators the data they need to pull fake reviews and shut sellers down.

And once delivery gets confirmed, the seller has what they wanted, a “verified” account that can push the product higher while she never benefits from it.

The Bigger Picture

Brushing scams are a small symptom of a large problem: personal data is cheap, abundant, and constantly traded. The package on your doorstep is the rare moment that hidden marketplace becomes visible.

Keep the socks if you want them. Then treat the delivery as the warning it is, lock down your accounts, and report the seller. The free gift was never the point. Your information was.

Nobody wants to be the prop in a stranger’s five-star story.

Want another “small act” that spirals into trust issues, read what micro cheating does after someone saves a number under a fake name.