Brushing: Unsolicited Parcel Scams
Receiving a parcel you never ordered sounds harmless, but it signals that scammers have your personal data and may be fraudulently boosting product reviews in your name.
Last reviewed: 1 June 2026
What this scam is
Brushing is a type of e-commerce fraud in which a seller dispatches cheap, lightweight goods to real postal addresses without the recipients ever placing an order. The apparent purpose is to generate verified purchase reviews: because the platform records a delivery to a real address, the seller can post a glowing five-star review as if from that address and have it appear as a genuine verified buyer review.
For the recipient, receiving an unexpected parcel may seem trivial or even a pleasant surprise. However, it is a signal that their name, address, and possibly their marketplace account details are in the hands of a third party — almost certainly obtained from a data breach, a scraped public profile, or a purchased data set. In some cases, recipients find fake reviews posted on their own marketplace accounts, or notice their accounts were used without their knowledge to place phoney orders.
Brushing is not victimless: it corrupts review systems that consumers rely on to make purchase decisions, and it places your personal data in the hands of actors willing to misuse it.
How it works
The operator has a database of real names and addresses, sourced from data breaches, scraped social profiles, or purchased from data brokers. They also have access to one or more marketplace seller accounts.
The operator places an internal 'order' using the victim's address as the destination. They ship an item that is light enough to make the postage cost negligible — often a cheap keychain, seeds, face mask, or similar small object. No payment is collected from the recipient; the operator funds the postage themselves.
The marketplace system records a successful delivery to a verified buyer. The operator then posts a highly positive review under that buyer's apparent account or the account linked to the transaction. The fake review raises the product's rating and visibility in search results, driving real sales from genuine customers who trust the inflated scores.
Why this scam works
The scheme works because marketplace review systems treat a recorded delivery to a real address as proof of a genuine purchase. Recipients are often too puzzled or indifferent to report it. The items are cheap enough that the cost is negligible relative to the visibility and sales uplift a higher rating provides. Because no obvious financial harm occurs to the recipient, the fraud goes underreported.
A typical pattern
A person receives a small padded envelope containing a cheap keychain and no sender address. They are puzzled but discard it. A few days later they check their marketplace account and notice a five-star review for an unfamiliar product appeared under their account — a review they did not write. They report this to the platform and discover an order was placed and delivered to their address, using their account details, without their knowledge.
Common red flags
- Parcel arrives addressed to you with no return address and no indication of who sent it
- Item inside is very cheap, lightweight, and not something you would order
- You find a review posted on your marketplace account that you did not write
- You receive an order confirmation for something you did not buy
- The parcel originates from an overseas warehouse address you do not recognise
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Your order has been delivered to [your address]. Thank you for your purchase!
[Marketplace review system] Your verified review has been posted. Rate your purchase: [product you never ordered]
Common variations
- Seeds-by-post variant — unsolicited plant seeds, often internationally mailed
- Fake gift card brushing — small gift card enclosed to encourage the recipient to think someone sent a gift and not investigate further
- Account takeover brushing — scammer has partial access to your account and places the brushing order through it directly
- Address farming — recipient details are then sold on to other fraudsters for targeted phishing or parcel redirect scams
How to verify before you act
If you receive a parcel you did not order, do not assume it is a gift or a mistake and ignore it. Check your marketplace accounts for any orders placed in your name that you did not make, and for any reviews posted under your account that you did not write. Contact the marketplace to report the brushing activity. Change your password and enable two-factor authentication as a precaution given that your personal data has clearly been obtained by a third party.
Payment methods used
- No payment from victim — operator funds the scheme themselves
Who is usually targeted
- Anyone whose name and address appear in a data breach
- People with public marketplace profiles or wishlists
- Anyone who has shopped on a marketplace that has experienced a data incident
What to do immediately
- Log into your marketplace account and check for orders or reviews you did not create
- Report the brushing activity to the marketplace's fraud or seller abuse team
- Change your marketplace password and enable two-factor authentication
- Keep the parcel as evidence but do not open it if it appears suspicious
- If you find reviews posted under your account, request they be removed
How to prevent it
- Report any unsolicited parcel to the marketplace you shop on most frequently — brushing often uses your account details
- Check your marketplace account for reviews or orders you did not create
- Enable two-factor authentication on all marketplace accounts
- Monitor your email for marketplace order confirmations you did not initiate
- If you receive seeds from an unknown overseas sender, report to your agricultural authority — some plant material is subject to import controls
Evidence to preserve
- The parcel itself, including any postage labels
- Screenshots of any reviews posted in your name
- Any order confirmation emails related to items you did not order
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Is it illegal to keep an unsolicited parcel?
In most jurisdictions, unsolicited goods sent to you can be kept without payment. However, the more important issue is what the parcel signals: that your address and possibly your marketplace account details are in someone else's hands. Report it to the marketplace and check your accounts rather than simply keeping the item.
Should I be worried about the contents of an unsolicited parcel?
The vast majority of brushing parcels contain harmless cheap goods. However, if the parcel contains plant material — particularly seeds — you should report it to your national agricultural authority, as there are import regulations around plant material that may apply regardless of whether you ordered it.