A package turns up with your name on the label and nothing you remember ordering inside. For about four seconds that feels like a good day, free stuff and no charge, until it sinks in that a stranger knew your name and address well enough to mail you a gift. And the gift, as it turns out, is the cheapest thing they walked away with. That’s a brushing scam, and the parcel is only the symptom. What it really tells you is that your personal details are circulating somewhere they were never meant to go.
Amazon pulled more than 275 million reviews in 2024 that it suspected were fake, and the following year it sued 75 firms for selling fake reviews, per Security.org. Brushing feeds that machine. Below: how the scam runs, why one mystery box matters more than it looks, and what you can actually do to give scammers less to work with.
What a Brushing Scam Actually Is
Once you know what the seller gets for that cheap trinket, the rest falls into place. They’re paying for a delivery confirmation attached to a real name, and a marketplace reads that as a real sale.
The Seller Is Buying a Verified Review, Not Sending a Gift
Picture a third-party seller sitting on a listing buried under thousands of near-identical ones. They want to climb the results. Two things push a product up: sales volume and good reviews, and that little “verified purchase” tag next to a review is what makes shoppers believe it. Earning those the honest way takes months. Faking them takes an afternoon.
So they spin up fake buyer accounts, ship their own product to a real address they dug up online, and let the delivery record pose as a genuine customer. A five-star review goes up under that name. The U.S. Postal Inspection Service says these boxes usually have no return address, or a retailer’s, and tend to trace back to an international third-party seller. A few dollars of shipping on some throwaway items, and they’ve manufactured a batch of credibility.
Where They Got Your Name and Address
Here’s the uncomfortable part. That package is proof your details are on sale, and there’s an entire industry doing the selling. Data brokers keep profiles on hundreds of millions of people, stitched together from public records, loyalty cards, app permissions, and old breaches. On a people-search site, a background check that spells out your home address, phone number, and relatives can run about a dollar. And most people never find out: roughly 91% of Americans have no idea their data is being sold, according to aggregated broker research.
A brushing scammer doesn’t hack anyone. They just buy the list. Your mystery box is the receipt telling you your name is on it.
Why the Package Is More Dangerous Than It Looks
Nothing gets charged to you, which is exactly why people wave it off. Three problems make that a mistake, and the newest one turns a passive symptom into a live attack aimed at your phone.
The QR Code on the Box Is the New Threat
Both the FTC and the FBI have flagged a newer wrinkle: the box now comes with a QR code, printed on the packaging or a thank-you card, dangling the promise of showing you who sent the gift or how to send it back. The FTC warning treats this as a real step up from the old version. Scan it and you often land on a phishing page built to grab your passwords and card details. Sometimes it kicks off a download that quietly plants malware.
The FBI’s Pittsburgh office laid it out plainly in a 2025 alert. Those packages arrive with no sender info on purpose, because a blank box is what makes you curious enough to scan. The curiosity is the whole trick.
The Contents Can Be Genuinely Unsafe
Whatever’s in the box was chosen to cost the seller as close to nothing as possible, and it often ships from places with loose safety oversight. Think cosmetics carrying ingredients no regulator has signed off on, food past its date with no label to warn you, a cheap gadget that never met a single safety standard. Don’t put it on your skin, don’t eat it, don’t plug it in.
A Fake Review Wears Your Name
Meanwhile, on some marketplace, there’s now a glowing review of a product you’ve never touched, sitting under your name. It steers the next shopper toward an overpriced knock-off, and it welds your identity to a listing you had nothing to do with. No charge hit your card. Your name still went to work for a scammer.
The Scale Behind the Mystery Box
One box on your doorstep reads like a fluke. Zoom out to the trade in personal data that makes it possible, and the fluke starts looking like a system.
What to Do When a Brushing Package Arrives
In the US you’re allowed to keep unsolicited merchandise, so forget the item for a second. The point is to shut the door the package just told you is open.
First, Rule Out a Real Gift, Then Leave the Code Alone
Skim your inbox for shipping emails, glance at your subscriptions, ask around the family in case someone’s playing surprise gift-giver. If nothing explains it, don’t scan any QR code on the box, don’t use what’s inside, and start treating the whole thing as evidence instead of a present. The FBI is blunt about the code: don’t scan ones from unknown senders, full stop.
Then, Lock Down the Accounts Tied to That Address
Log into whichever marketplace the item probably came from and hunt for orders or reviews you don’t recognize, then report the brushing scam through the platform so any fake review under your name gets taken down. Swap the password on that account and its linked email, and anywhere else you reused the same one. Switch on two-factor authentication. Keep half an eye on your bank statements and credit report for charges or new accounts you never opened, and file a report at reportfraud.ftc.gov so it feeds the pattern regulators track.
How to Shrink Your Exposure Going Forward
Wiping yourself off every broker list overnight isn’t realistic. Slowing the flow of fresh data into them is, and so is cutting off the parts of the scam that reach your device.
Give Fewer Sites Fewer Details
Every throwaway signup is a future entry on somebody’s list. Skip the accounts you don’t really need, lean on services you already trust over some app you’ve never heard of, and leave your full name, birthdate, and address off any form that doesn’t genuinely require them. Strong, unique passwords in a password manager mean one breach doesn’t hand over everything else. Data removal services can nudge brokers into deleting what they hold, though the records tend to creep back later, so think of it as upkeep rather than a one-and-done.
Where ZoogVPN Draws the Line
Let’s be straight about it: a VPN can’t yank your name and address off a broker’s list, and anyone telling you it single-handedly stops brushing packages is selling you something. What ZoogVPN does cover is the half of this that touches your device, plus the exposure you rack up while browsing. Its ad and tracker blocker keeps a lot of malicious and phishing domains from loading at all, so a QR code pointing at some fake prize page stands a decent chance of just not resolving. AES-256 encryption makes your traffic unreadable on public Wi-Fi, the kind of network where trackers and eavesdroppers quietly harvest the data points that end up in the profile a scammer later buys. And because the no-logs policy runs under Greece’s jurisdiction, outside the big surveillance alliances, ZoogVPN’s own servers aren’t sitting on a browsing history for some future breach to spill.
One account stretches across up to 10 devices, and that number earns its keep. The weak spot in most households isn’t the person reading a privacy article. It’s the older relative’s phone, or the shared laptop that scans the code first and thinks about it never. Push the same tracker blocking and encryption onto all of them and you’ve closed gaps you’d otherwise never have spotted.
A mystery box is a signal. Treat your connection like it’s already being watched.
ZoogVPN encrypts your traffic with AES-256, blocks trackers and malicious domains, keeps no activity logs, and covers up to 10 devices. Start on the free 10 GB tier.
The Bottom Line on Brushing Scams
A brushing package isn’t a windfall, and it’s rarely someone stealing from you directly. It’s confirmation that your name and address slipped out of your hands and onto a list somebody paid money for. Toss the item if you want. Just don’t toss the warning: change the passwords that box implicates, leave the QR code unscanned, tighten what you hand over next time, and let every out-of-nowhere delivery remind you how far your data has already wandered.
Frequently Asked Questions
Should I be worried about a brushing scam?
Worried enough to do something, not enough to lose sleep. No money leaves your account, but the box confirms your name and address are circulating from a breach or a broker sale. Change the password on the account tied to that address, turn on two-factor authentication, and keep an eye on your credit report for accounts you didn’t open.
Why did I receive a package I never ordered?
If it isn’t a gift from someone you know, it’s most likely brushing: a seller ships their own product to your address so they can post a fake verified review under your name. Some versions also tuck in a QR code meant to phish more of your data or slip malware onto your phone.
Do I have to pay for or return the item?
No. Under FTC rules on unordered merchandise, anything sent to you that you didn’t order is yours to keep, and you owe the sender nothing. If it’s unopened and you’d rather not hang onto it, mark it “return to sender” through the postal service.
Is it safe to scan the QR code to find out who sent it?
No. The FBI and FTC both warn that these codes usually lead to phishing sites out to steal passwords and card details, and some trigger a malware download. The missing sender info is bait, there to make you curious enough to scan. Leave it be.
- Diana BestaievaContent Writer at ZoogVPN. Diana deeply explores the newest technologies and shares valuable insights engagingly and comprehensively. Keeping up with the tech news, she makes in-depth content, explaining complex concepts with ease.
