The Brushing Scam: What is it, How to Avoid it, and What to Do [2024]

February 23, 2024
·
3 min
deleteme

Protect yourself from future breaches

Brushing scams don’t have a direct financial impact on victims. In fact, you get free goodies. But you should still be concerned if you’ve become a brushing scam victim.

Here’s why: An unethical ecommerce seller out there has your personal information without your consent.

While brushing scams may not empty your bank account, they’re a red flag telling you that your information is available to fraudsters.

Brushing scams are becoming more common—about one million UK households may have been targets of brushing in 2021 according to a survey by Which? magazine. The good news? It’s easy to protect your private information and prevent cybercriminals from using it for more serious crimes.

In this guide, we explain everything you need to know about brushing scams and what you can do to protect yourself.

What is a brushing scam?

A brushing scam is a fraudulent scheme where a seller on an ecommerce platform or online marketplace (like Amazon or eBay) creates fake orders to collect positive reviews.

The seller steals or buys personal information of people from various sources like data breaches, the dark web, and hacked accounts. Or maybe a website you use regularly and trust sold your data for profit.

The seller creates a fake account using this information and places an order for the product they’re selling—these are generally cheap products. Once the order is marked as delivered, the seller logs into the fake account to add a positive review.

Why is it called “brushing?”

In the context of ecommerce, brushing refers to a technique where sellers artificially “brush” up their product’s reputation with fake positive reviews. This makes the seller’s product look more trustworthy and popular than it actually is and boosts their ranking on online marketplaces.

How does the brushing scam work?

brushing scam

The brushing scam is one of the less harmful cons currently going around this year. However, it’s still an indicator of a much larger issue with a consumer’s data and can turn nasty when the scammer attempts to force the recipient to pay for goods they did not purchase.

When the scam plays out, most victims can expect the following:

  1. Step One: The scammer finds data (people’s names, addresses, and more) via data broker sites, the dark web, and other sources.
  2. Step Two: A person receives a package or parcel in their regular mail that they did not order.
  3. Step Three: The scammer then uses the confirmed postal receipt of these goods to post fake reviews under the recipient’s name online.
  4. Step Four: These reviews are used to inflate online sale numbers, improve ratings, and fool new customers into purchasing low-quality items.
  5. Step Five: Rinse and repeat.

In this type of scam, the criminal loses nothing but cheap goods because they are essentially paying themselves. It can result in a big profit for a little bit of extra effort.

While this may seem like a great way to get free merchandise, it’s actually a huge indicator that a person’s data is currently available to scammers online. Names, addresses, and sometimes phone numbers are stolen and used to perpetrate this type of fraud.

And in some instances, the scammers will reach out to the person who received the goods pretending that the products were sent to them by mistake. They may try to intimidate the victim into sending them money to pay for the items or even offer to show up at the address to take possession themselves.

Not only are they using identity theft to bolster store reviews, but they’re also tricking potential buyers into purchasing low-quality goods. 

Who does the brushing scam target?

The brushing scam does not discriminate. If a person’s contact information is available online due to a data breach or unauthorized posting by a people tracking site, then scammers consider it fair game.

All that is needed to meet the requirements is a name, address, and phone number, and a physical address that usually isn’t a P.O. box. This info is enough for criminals to create shopping accounts at places like Amazon or drop shipping sites using someone else’s identity. 

Then, the fake reviews and sketchy shipments start rolling in.

What to Do If You Are a Victim of a Brushing Scam

The most obvious sign you’ve been targeted by a brushing scam is the sudden receipt of packages that no one in your house ordered. These may contain cheap goods, or even be empty boxes stuffed with paper or some sort of filler to increase the weight.

Here’s what to do if you think you might be a victim of a brushing scam.

Notify your post office

When this occurs, immediately notify your post office and make an effort to return the packages to avoid being accused of theft. Gather relevant information—tracking numbers, package labels, and documentation—before you contact the post office. After you’ve notified the post office, monitor your mail for any more unsolicited packages.

Contact the retailer

Next, get in contact with the retailer that the scammer used as a facilitator for their operation. This is usually a place like Amazon or Walmart that allows external parties to sell under their platform. Notifying them quickly can help them identify other instances of the scam and ban the seller behind it.

Report to the police if needed

Never give anyone money for a package that you didn’t order. If you receive threatening messages or the scammer attempts to intimidate you, call the police and immediately report the behavior.

Change passwords & protect your accounts

Make sure to change all passwords, usernames, and phone numbers where possible to prevent this from happening again.

The easiest way to do this? With Cloaked. Cloaked generates unique identities for you in seconds. Each identity can have a unique phone number and email. Use these details whenever you want to sign up on an online marketplace, dating website, or anywhere you’d rather not share personal information.

facebook

Cloaking identities is fairly easy; here’s what you need to do:

  1. Join Cloaked.
  2. After logging into your account, click on New Identity and enter a name.
  3. You’ll see various options in the Your Identity section, including phone, email, and username. Click the Generate button next to a field.

And that’s it. You now have an email and phone number that can forward emails and calls to your primary account. When push comes to shove, you can get rid of your identity in seconds.

It’s also helpful to use some form of identity theft or data breach monitoring to try and track down the source of the leak where these scammers may have gotten your information.

Impacts of Brushing scams

Brushing scams aren’t the scariest of privacy crimes. But they have a significant impact on your overall privacy and security. We dive deeper into the three prominent impacts of brushing scams below.

Exposure to financial & personal information

When you receive an unsolicited delivery and find out about brushing scams, your first question probably is: How did the person get my name and address? That’s a valid question.

Someone with access to your personal information can do a lot more than just send harmless merchandise to your doorstep. They could use your personal information for more fraudulent activities like identity theft and unauthorized financial transactions.

Financial fraud is becoming more rampant each year. According to the FTC, people lost nearly $8.8 billion to fraud in 2022—an increase of $2.6 billion from 2021. Access to your personal data might not directly give hackers access to your bank account, but it does give them a great starting point.

data breaches and leaks graph

Your name is being used without your permission

The seller has added a review with your name attached to it. If you’re not comfortable with someone using your name without consent, report these fake reviews to have them removed. What’s even scarier is that your personal data can be used for more than fake reviews, like identity theft.

According to the Bureau of Justice Statistics, 9% of U.S. residents (23.9 million people) aged 16 or older were victims of identity theft in 2021.

“Identity theft is a pervasive issue in the United States and has been for several decades.”

-Axton Betz-Hamilton, identity theft expert and consumer affairs professor, South Dakota State University

In some cases, identity thefts occur because fraudsters have acquired personal data through phishing or other scams—these are also the sources where sellers find personal data for brushing scams.

Most of these cases involved the misuse of credit cards—in 2022, over 440,000 identity theft cases involved credit card fraud.

You could become a victim of more Brushing scams

Individuals who have already become victims of a brushing scam are easy targets for more brushing scams. Once a seller has your personal data, they might continue to send unordered merchandise to add reviews to more products.

This is why reporting any suspicious activity to authorities and remaining vigilant is mission-critical. It’s even more important to improve your online security by limiting the data you share online, storing credentials in a strong password manager, and using disposable emails and phone numbers.

Learn more about Brushing scams

Not everyone is familiar with brushing scams or how to deal with them. We discuss some common questions about brushing scams below.

How do you fix a brushing scam?

You can’t technically “undo” a brushing scam because brushing scam victims don’t lose anything except privacy. But you can take steps to prevent becoming a brushing scam victim in the future. 

Here’s what you can do:

  • Document the incident: Keep records of the merchandise you received as well as accompanying documentation.
  • Notify the post office: Notify your local post office about the brushing scam. Provide as much information as possible—include the date, shipping information, and other details.
  • Review accounts: Monitor credit card and other financial accounts for unauthorized transactions. If you see anything suspicious, report it to the authorities immediately.
  • Change your password: Change your passwords for all online accounts to secure your data.
  • Report fake reviews: If you’re able to find fake reviews in your name, report them to the online marketplace and request their removal.
  • Protect your data: Safeguard your personal information against more data breaches using a reliable password manager.

What to do if I receive a package that I didn't order?

If you receive a package you didn’t order, you might have been a victim of a brushing scam. Investigate the product listing on the marketplace to look for fake reviews. If you have reason to believe it’s a brushing scam, report it to the authorities right away and take steps to protect your privacy.

What does order brushing mean?

Order brushing refers to placing an illegitimate order using a person’s name without their consent to collect fake positive reviews for the product.

A seller steals a person’s information, creates an account in their name on an online marketplace or ecommerce platform, and places an order without their consent.

Once the order is delivered, the seller adds a positive review to improve the product’s ranking and reputation.

Protect yourself from Brushing scammers with Cloaked

The brushing scam is a direct result of criminals gaining access to your personal contact information. However, when you use Cloaked, you have an additional line of defense that allows you to delete any identity as soon as you learn that it’s been compromised.

Doing so cuts scammers like this off at the knees, and makes it harder for them to target you in the future.

Click here to get Cloaked.

Protect yourself from future breaches

View all
Privacy Tips
September 29, 2024

Navigating Love Safely: Avoiding the Dangers of Doxxing and Stalking from Dating Apps

Navigating Love Safely: Avoiding the Dangers of Doxxing and Stalking from Dating Apps

by
Abhijay Bhatnagar
Privacy Tips
September 29, 2024

Navigating Love Safely: Avoiding the Dangers of Doxxing and Stalking from Dating Apps

Navigating Love Safely: Avoiding the Dangers of Doxxing and Stalking from Dating Apps

by
Abhijay Bhatnagar
Privacy Tips
September 22, 2024

Best Practices for Safeguarding Your Information: A Job Seeker's Guide

Best Practices for Safeguarding Your Information: A Job Seeker's Guide

by
Arjun Bhatnagar
Privacy Tips
September 22, 2024

Best Practices for Safeguarding Your Information: A Job Seeker's Guide

Best Practices for Safeguarding Your Information: A Job Seeker's Guide

by
Arjun Bhatnagar
Privacy Tips
September 19, 2024

Lock It Down: Essential Data Security Measures for Small Businesses

Lock It Down: Essential Data Security Measures for Small Businesses

by
Abhijay Bhatnagar
Privacy Tips
September 19, 2024

Lock It Down: Essential Data Security Measures for Small Businesses

Lock It Down: Essential Data Security Measures for Small Businesses

by
Abhijay Bhatnagar