A box shows up on a doorstep addressed correctly but containing something nobody remembers ordering, often a cheap gadget, a bag of seeds, or a piece of costume jewelry. Rather than a shipping mistake, the package is frequently part of a deliberate scheme in which a third-party seller ships unsolicited merchandise to a real address purely so it can be marked “delivered” and used to post a glowing review under the recipient’s name, without that person ever placing an order.
The Review-Manipulation Business Behind the Boxes
Online marketplaces rank products partly by their volume of reviews from verified purchasers, and a seller with a large stack of five-star ratings tends to outsell a competitor offering an identical product but carrying fewer reviews. Sellers exploit that ranking system by creating fake buyer accounts, shipping a real physical item to a real address to generate a verified purchase, and then posting a positive review under that account without the actual resident ever placing an order or seeing the product beforehand.
The scheme works because marketplaces generally cannot easily tell the difference between a genuine purchase and a package sent purely to fabricate one, since both involve a real shipment landing at a real address with tracking information to match, and both produce a “verified purchase” label that shoppers are trained to trust.
Why a Real Name and Address End Up on the Label
Sending a fake order to a made-up address would not produce a valid delivery confirmation, so the scheme depends on using addresses tied to real people rather than invented ones. According to Wikipedia’s description of brushing, those addresses typically come from data that has leaked in a prior data breach, been scraped from public directories, or been purchased in bulk from brokers who resell contact information with little scrutiny over how the buyer intends to use it.
Because the targeted person never placed an order and never provided payment information to the sender, brushing packages generally do not represent a direct financial theft against the recipient in the way a stolen card number would. The greater concern is what the presence of a working address and name on a scammer’s list implies about how many other pieces of personal data may have been exposed alongside it.
What an Unwanted Package Actually Signals
Receiving a brushed package is a strong indicator that a name, address, and possibly an email address are circulating somewhere a legitimate order was never placed to begin with. That combination of details is often enough on its own to enable further targeting, since a scammer or data broker who already has a verified working address may attempt other schemes against the same person, from unsolicited sales calls to more elaborate phishing attempts referencing the recent unexpected delivery.
Some recipients also discover, when they check their own account on the online marketplace the package came from, that a review has been posted under their name for a product never actually bought, which is often the first concrete sign that an account has been used without permission by someone else entirely.
How Marketplaces Have Tried to Fight Back
Large online marketplaces have adjusted their review systems over time in response to brushing and similar manipulation tactics, including delaying when a “verified purchase” label appears, monitoring accounts for unusual patterns of reviews posted shortly after shipment, and suspending sellers found to be behind repeated waves of fake reviews. Those countermeasures reduce but do not eliminate the practice, since sellers running the scheme can rotate through new accounts and new batches of addresses whenever an old set gets flagged or shut down.
The scale of the problem is difficult to measure precisely because brushing, by design, is meant to look identical to a normal shipment on the surface, and most recipients who simply discard an unwanted package never report it anywhere. That underreporting means the practice likely persists at a scale larger than official complaint numbers alone would suggest.
Legal Rights Over Merchandise Nobody Ordered
Federal Trade Commission guidance has long held that recipients of unsolicited merchandise are generally entitled to keep it or dispose of it without payment, since no valid order or contract exists behind the shipment in the first place. Checking the marketplace account tied to the address for reviews posted without authorization, and removing any that turn up, closes off the immediate misuse of that account before it does further damage.
Changing the password on the associated shopping account and enabling two-factor authentication where available addresses the more likely root cause, since an account takeover or a leaked password is frequently how a name got matched to a real address in the first place, long before any box ever arrived.
Reporting the Package to Cut Off the Scheme
Reporting the shipment directly to the marketplace where the seller operates helps flag the account responsible, since repeated brushing complaints tied to one seller are one of the clearer signals platforms use to investigate and remove fraudulent review activity from their listings. Filing a report with a national consumer-protection agency adds the incident to a broader pattern that regulators track across sellers and marketplaces over time.
None of these steps requires returning the item or contacting the sender directly, and doing so is generally discouraged, since replying can confirm to a scammer that the address is active and monitored, feeding the same pool of verified addresses that fuels other forms of identity theft down the line.
This article was produced with the assistance of AI and reviewed by Morning Overview editors.
More from Morning Overview
