You bought a sealed gift card, loaded it, and it was already drained. Here is how scammers empty cards in the store before you ever pick them up, and what to check before you pay.
The Mystery Package: What a Brushing Scam Really Means
A package shows up with your name on it, and you never ordered it. Free stuff sounds nice, but it’s a sign something else is going on. Here’s what brushing is and what to do.
A package lands on your doorstep with your name and address on it. Inside: a phone case, a cheap flashlight, a pack of seeds, maybe a weird crocheted doll. You didn’t order any of it.
Free stuff! Right? Not exactly.
In plain English
The package isn’t the scam, it’s the receipt. It proves someone has your name and address and is using them to post fake reviews that look like they came from a real buyer.
Why would anyone send you free stuff?
Online stores rank products higher when they have lots of “verified purchase” reviews. So some sellers invent customers. They find a real name and address, “sell” a product to that person, ship something cheap so there’s a real delivery on record, and then post a glowing five-star review under that fake order.
You’re just the delivery address that makes the review look legit. That’s called brushing.
Is it dangerous?
The item itself is usually harmless. What it tells you is the part to pay attention to: your personal information is out there, probably from a data breach or a purchased list. And a few versions are riskier:
- A QR code inside that promises a prize or asks you to “confirm your gift.” Don’t scan it.
- Packages ordered under your own shopping account. That means someone may have your login, not just your address.
- Your address used as the return address on packages you never sent.
What to do
- You can usually keep it. In the U.S., you’re not required to pay for or return merchandise you didn’t order.
- Check your shopping accounts. If the order shows up in your own account history, change that password right away and turn on two-factor authentication.
- Report it to the marketplace so they can pull the fake reviews.
- Don’t scan codes or visit links that come inside the box.
Side note
A single mystery package is mostly a nuisance. But treat it like a smoke detector chirping: nothing’s on fire, but it’s a good moment to check that your passwords are unique and your accounts are locked down.
Too long, didn’t read
- Brushing is when sellers ship you something so they can post fake “verified” reviews.
- It means someone has your name and address.
- You can usually keep the item, but don’t scan any codes inside.
- If the order is in your own account, change your password now.
Get the scam going around this week, every week.
One short email: the scam making the rounds, one tech word made simple, and one tip to keep you and your family safe. Free, no spam, unsubscribe anytime. Plus a free printable "How to Spot a Scam" sheet for your fridge.
We send one email to confirm it's really you. Your address stays with us and our email service, nobody else. Privacy
Keep reading
A call says your power will be shut off tonight unless you pay right now. Real utility companies send written notices first. Here is how to spot the fake before you panic.
A package you never ordered shows up with an Amazon smile and a QR code inside. Scan it and you land on a fake Amazon sign in page. Here's how the trick works and what to do instead.