A package arrives that you never ordered — a phone case, some seeds, a cheap gadget — with your name and address on it but no clear sender. It seems like a harmless mix-up or even a free gift. In fact it may be a brushing scam, and it is a quiet sign your details are being used. Our GetMyPassword team explains what a brushing scam is and what to do.
What a brushing scam is
A brushing scam is when a seller ships you cheap items you never ordered so they can post a fake “verified” review in your name. To make their products look popular, shady sellers create orders using real names and addresses, send something low-cost to make the purchase look genuine, and then write a glowing review as if you, a real buyer, left it. You are not charged — but your name and address are being used without your knowledge.
Why an unordered package is a warning
The free item is not the problem; what it reveals is. A brushing package means your name and address are circulating in a list a stranger is using, often from a past data breach or scraped from somewhere. It can also signal that someone has enough of your details to create activity in your name. Treat it less as a gift and more as a nudge to check that your accounts and personal data are still under your control.
What to do if it happens
- Do not pay anyone — a genuine brushing package is free; any “payment due” message is a separate scam.
- Report it to the marketplace it shipped from so they can act on the fake reviews.
- Check your accounts on that marketplace for orders or reviews you did not make.
- Change your password there, and anywhere you reused it, then turn on two-factor authentication.
- Watch for other signs of misused data, like unexpected account emails or charges.
A brushing package is not a gift — it is a receipt showing your name and address are on someone’s list. The smart response is to check and tighten your accounts.
How to protect your data
You cannot unsend a package, but you can shore up what it exposed. Review the security of your marketplace accounts, remove saved details you do not need, and stay alert for phishing that may follow. Most importantly, make sure a leaked name and address cannot become a leaked account: give every login a unique password from our password generator and turn on two-factor authentication, so misused details stop at your front door.
Frequently asked questions
What is a brushing scam?
It is when a seller ships you cheap items you never ordered so they can post a fake verified review in your name. It makes their products look popular and uses your real name and address without your knowledge.
Is a brushing package dangerous?
The item itself is harmless and free, but it signals that your name and address are circulating on a list. Treat it as a prompt to check your accounts for fake activity and to tighten your passwords and two-factor authentication.
What should I do if I receive one?
Do not pay anyone, report it to the marketplace, check your account there for orders or reviews you did not make, change your password and reused copies of it, and enable two-factor authentication. Watch for other signs of misused data.