A brushing scam — sometimes called a brushing scheme or fake review scam — is an e-commerce fraud practice in which online sellers ship cheap, unsolicited packages to real addresses, then use the recipient's name and address to post fake positive reviews for their own products on platforms like Amazon, eBay, and Walmart. The seller creates the appearance that a verified purchase was made and a genuine customer left a five-star review, boosting their product's ranking and visibility.
The term "brushing" comes from the Chinese e-commerce practice of shuadan, or "brushing orders" — a technique sellers on platforms like Taobao and AliExpress have used for years to artificially inflate their sales numbers and ratings. As Chinese sellers expanded to Western marketplaces, the practice spread to Amazon, where it became a significant problem that Amazon has been fighting with varying degrees of success.
From the victim's perspective, a brushing scam means you receive a package you didn't order — often a small, cheap item like a hair tie, a phone case, a packet of seeds, or a piece of jewelry. There is no return address or invoice inside. You didn't pay for it, and you didn't order it. While receiving free stuff may seem harmless, the scam indicates that your name and shipping address have been compromised — and the fake reviews inflated by brushing harm other consumers who rely on ratings to make purchasing decisions.
To execute a brushing scam, a seller needs three things: a product listing on a marketplace, a supply of real names and addresses, and the ability to ship cheap items at low cost. The seller obtains names and addresses through data breaches, leaked customer databases, or by purchasing mailing lists. They then ship a low-cost item — typically under $2 — to the victim's address. The package may have a real return address (the seller's warehouse) or no return address at all.
Once the package is marked as delivered, the seller creates a fake buyer account using the victim's name and address. Because the marketplace sees that a package was delivered to that address, the account appears to be a verified purchaser. The seller then writes a glowing five-star review for their own product from this fake account. They repeat this process hundreds or thousands of times, accumulating fake reviews that push their product higher in search results and bestseller rankings.
The items sent are intentionally cheap because the seller's goal isn't the product itself — it's the verified review. The cost of the item and shipping is a marketing expense, far cheaper than legitimate advertising. Some brushing operations send items that aren't even the product being reviewed — the package might contain seeds, while the fake review praises a Bluetooth speaker. The connection between the shipped item and the reviewed product is irrelevant to the scammer.
The package itself is generally not dangerous. You haven't been charged for the item, and the items are typically harmless consumer goods. You are not legally obligated to return or pay for unsolicited merchandise — under US law (39 USC § 3009), you have the right to treat unordered merchandise as a free gift.
The real risk is what the brushing scam reveals about your personal data. If a seller has your name and address, that information came from somewhere — a data breach, a compromised account, or a leaked database. This means your personal information is circulating in places it shouldn't be, which could expose you to other scams, identity theft, or phishing attempts. You should change passwords for any accounts that may have been compromised, enable two-factor authentication, and check your marketplace accounts for unauthorized orders or changes.
There is also a secondary concern: some brushing packages have contained suspicious seeds — the infamous "mystery seeds from China" that prompted USDA warnings in 2020. While most were harmless, agricultural officials expressed concern about invasive species or plant pathogens. If you receive unsolicited seeds, do not plant them — report them to your local agricultural authority.
First, check your marketplace accounts. Log into Amazon, eBay, Walmart, and any other shopping platform you use and look for unauthorized orders, changes to your shipping address, or new payment methods you didn't add. Change your password and enable two-factor authentication on any account that shows signs of tampering.
Report the brushing package to the marketplace. Amazon has a dedicated process for reporting unsolicited packages — search for "report unsolicited package" on Amazon's help pages. The platform uses these reports to identify and suspend sellers engaged in brushing. You can also report it to the FTC and your state's consumer protection office.
Do not use the product if you have any concerns about its safety or origin, and never scan any QR codes or visit any URLs included in the package — some brushing scams have evolved to include phishing links or QR codes that lead to scam websites. If the package contains a link or QR code directing you to a website, check that URL with our $1 scam risk report before visiting it.
Some brushing scams include phishing URLs or QR codes that lead to scam websites. Before you visit any link from an unsolicited package, paste the URL into Scam Detective for a $1 scam risk report with a 0–100 score, all five red flags, and a 3-step action checklist.
Check a URL — $1 →