Walmart Brushing Scam — Unsolicited Packages and Fake Marketplace Reviews
Third-party Walmart Marketplace sellers send unsolicited packages to real addresses to post fake verified-purchase reviews, sometimes indicating personal data exposure.
Part of: Brushing: Unsolicited Parcel Scams
Last reviewed: 7 June 2026
Walmart Marketplace hosts thousands of third-party sellers alongside Walmart's own retail inventory. This open-marketplace model, similar to Amazon's, enables a brushing scheme in which unscrupulous sellers create fictitious orders using real names and addresses, ship inexpensive items to those addresses, and post positive verified-purchase reviews to boost their product rankings.
Victims receive packages they never ordered — lightweight items such as seeds, keychains, or small accessories — with no identifiable return address or a forwarding address from an overseas fulfilment centre. The item is harmless, but its arrival confirms that the victim's personal address data is circulating in databases accessible to scammers.
Walmart takes brushing activity seriously as a violation of its marketplace seller policies, and recipients of unsolicited packages are encouraged to report them.
How this scam works on the Walmart brand
On Walmart.com, genuine orders are visible under Account > Purchase History. If a parcel arrives without any corresponding order in your account, and you are not aware of a gift being sent to you, it is likely a brushing shipment. The sender details may show a generic name or a fulfilment address in China with no way to contact the sender.
The brushing seller creates a ghost order using your publicly available or breached address data, ships the cheapest possible item via bulk postal services, and then posts a review for their product under the purchaser's account or a fake account listing the verified order number. The review algorithm treats this as a genuine verified purchase.
A more concerning variant occurs when the brusher has accessed an actual Walmart.com account and placed a real order using saved payment information. In this case, a charge will appear on the linked card, and the order will be visible in your account — but shipped to a different or unfamiliar address.
Common red flags
- A package arrives addressed to you but no corresponding order exists in your Walmart account
- The packaging has no recognisable return address or shows a generic overseas sender
- Inside the package is a QR code or a card directing you to a website
- You notice a review posted on your Walmart account for a product you have never purchased
- Your Walmart account shows an order you do not recall placing, or a new delivery address has been added
How to protect yourself
- Check your Walmart account at Walmart.com — if the package has no corresponding order, your payment was not charged for this shipment
- Change your Walmart.com password and enable two-step verification if you receive an unexpected package, as your address data has been exposed
- Do not scan QR codes found inside unexpected packages
- You are not legally required to return unsolicited merchandise in most jurisdictions
- Check your account for any reviews you did not write and report them to Walmart
How to report it
- Report the unsolicited package to Walmart at Walmart.com/help — select the relevant contact option for marketplace sellers
- If a fraudulent review was posted on your account, contact Walmart Customer Care to have it removed
- Report to the FTC at reportfraud.ftc.gov
- If your account was charged, contact Walmart Customer Care and your bank immediately
Frequently asked questions
Is receiving an unexpected Walmart package a sign my account was hacked?
Not necessarily. Your address may have been obtained from a data breach or data broker list without your Walmart account being accessed. However, you should still change your password, enable two-step verification, and check your account for unauthorised changes.
Can I keep the item that arrived unexpectedly?
In most jurisdictions, including the US and UK, you are entitled to keep unsolicited merchandise without obligation to pay for or return it. However, do not scan any QR codes or visit any websites referenced in the package.