Last updated on February 25, 2025

Have you ever received something you didn’t remember ordering from Amazon? Or, have you seen people on the internet talking about receiving mysterious packages? Be careful. Amazon brushing scams are on the rise again!

What is a brushing scam?

Brushing scams, or review scams, are what scammers use to get lots of fake positive comments on their product listings by sending people ghost packages without their consent. Brushing scams happen on online marketplaces like Amazon and Best Buy.

First, they gain access to your leaked personal information (like your address, for example) from data breaches or after a phishing scam. That’s how they know where to send the packages (normally the items inside are exceptionally cheap).

By pulling off these scams, they can create a flood of 5-star reviews with glowing comments for their products, making them seem much more attractive to potential buyers. In short, they make use of these ghost purchase records to boost their online store’s reputation.

QR code brushing scams (updated on Feb 25, 2025)

QR Code brushing scam is a form of brushing scams where scammers put a QR code in the unsolicited packages.

Besides getting a bogus product review under your name, scammers also try to trick you into scanning the QR code using various excuses. For example, they might ask you to scan to know who the sender is.

The QR code leads to phishing websites that are designed to steal your personal information. With it, scammers can commit other crimes, such as identity theft. Watch out!

Red flags of a brushing scam

• You receive something you didn’t order.
• You can’t find a return address on the package.
• You didn’t write a review, but you name appears on the reviews on the product listings.

What are the concerns of brushing scams?

Scammers can only send you packages after they’ve got your home address, but it is also possible that they’ve managed to get their hands on other data like your Social Security number, credit card information, or other banking details.

They can use the data to commit identity theft and other cybercrimes – to open a bank account in your name, to clone your credit card, or even to take over and empty your bank account!

How to protect yourself from brushing scams

• Change your passwords and check the security status of your online accounts. If you think your account has been compromised or hacked by scammers, you should set up a new account.
• Turn on 2FA to better protect your account.
• Check your financial statements regularly to see if there are any suspicious activities and contact your bank immediately if so.
• Report the retailer/online shop to Amazon / Best Buy. Contact customer service directly and let them investigate the issue. Also file complaints with the Federal Trade Commission (FTC), Internet Crime Complaint Center (IC3), or Better Business Bureau (BBB).
• It is best to NOT accept packages you didn’t order. However, according to the FTC, you have the right to keep the goods.

A helping hand from Trend Micro

Traditional antivirus software is not enough today. That’s why we created Trend Micro ScamCheck, which offers comprehensive protection from deceptive phishing scams, scam and spam text messages, deepfakes, and more:

• Scam Check: Instantly analyze emails, texts, URLs, screenshots, and phone numbers with our AI-powered scam detection technology. Stay secure and scam-free.
• SMS Filter & Call Block: Say goodbye to unwanted spam and scam calls and messages. Minimize daily disruptions and reinforce your defenses against phishing.
• Deepfake Scan: Detect deepfakes in real-time during video calls, alerting you if anyone is using AI face-swapping technology to alter their appearance.
• Web Guard: Surf the web safely, protected from malicious websites and annoying ads.

With the increasing number and sophistication of scams, staying one step ahead is more crucial than ever. Available on both Android and iOS, why not try ScamCheck today?

Protect your identity online

Without data leaks, brushing scams wouldn’t be possible. They’re how scammers obtain people’s personal information. To save yourself from having your personal data accessible to scammers on the internet and the dark web, try Trend Micro ID Protection!

With ID Protection, you can:

1. Check to see if your data (email, number, password, credit card) has been exposed in a leak, or is up for grabs on the dark web;
2. Secure your social media accounts with our Social Media Account Monitoring tool, with which you’ll receive a personalized report;
3. Create the strongest tough-to-hack password suggestions from our advanced AI (they’ll be safely stored in your Vault);
4. Enjoy a safer browsing experience, as Trend Micro checks websites and prevents trackers.
5. Receive comprehensive remediation and insurance services, with 24/7 support.

Offering both free and paid services, ID Protection will ensure you have the best safeguards in place, with 24/7 support available to you through one of the world’s leading cybersecurity companies. Trend Micro is trusted by 8 of the top 10 Fortune 500 Companies — and we’ll have your back, too.

As always, we hope this article has been an interesting and/or useful read. If so, please do SHARE it with family and friends to help keep the online community secure and informed — and consider leaving a like or comment below.