Brushing Scams Start at Your Door 

Brushing Scams Start at Your Door

By Greg Collier

A surprise package on your doorstep may seem like a harmless fluke or a lucky mistake. But if you didn’t order it, it could be a warning sign that your personal information has fallen into the wrong hands.

The U.S. Postal Service is raising awareness about a growing fraud known as a brushing scam. These scams involve third-party sellers sending unsolicited, low-cost items, such as socks, kitchen gadgets or trinkets, to real names and addresses. While the package itself might appear innocuous, its arrival often means that your name, address and possibly more sensitive data are already circulating among cybercriminals.

At the heart of this scheme is a tactic used to game online retail platforms. After sending out items, the scammers leave positive reviews in the recipient’s name to boost the product’s visibility. This process creates fake but “verified” buyer accounts. It may start with a small item, but experts warn that brushing scams are rarely isolated incidents. The presence of such a package suggests that personal data may have been scraped, bought, or stolen from compromised databases.

The concern doesn’t end with phony reviews. The misuse of your identity in this way can indicate a much broader security issue. Stolen data can be used to commit financial fraud, steal identities, impersonate users, or circumvent authentication protocols on secure accounts. With information like your full name, home address, and even phone number, scammers can initiate phishing campaigns, open unauthorized accounts or execute social engineering attacks.

If you receive a package you did not order, it’s important to take it seriously. While there may not be an immediate financial loss, the presence of such a package can indicate that your personal information is at risk. It’s recommended to report the incident to the U.S. Postal Inspection Service, monitor financial and retail accounts for irregularities, and take precautions such as changing passwords. Even if fraud hasn’t occurred yet, these steps can help prevent future harm.

One important note is to avoid engaging with the package in any way. Scanning QR codes, leaving reviews, or attempting to return the item may confirm to the sender that your address is valid, potentially inviting further contact or exploitation. Some scammers may include counterfeit postage or links to malicious websites, further complicating matters.

Treat any unexpected delivery with caution. A mystery box might seem like a minor curiosity, but it can be the first clue that your identity is being used without your knowledge. By staying vigilant and proactive, you can reduce the risk of falling victim to a larger and more damaging scam.