Brushing Scam Attacks: How Retailers Can Detect and Stop Them

Fraudsters are abusing retail platforms to generate fake orders, manipulate reviews, and damage brand trust. Here’s what retailers need to know to spot—and stop—it

What’s Happening with Brushing Scams

Retailers are seeing a noticeable rise in unsolicited package deliveries tied to fraudulent “brushing” activity. A brushing scam is a scheme where scammers place fake orders using stolen or fabricated customer data, often shipping low-cost items to real people, to manipulate reviews and boost seller ratings.

These shipments show up at random doorsteps, even though the recipient never placed an order.

Behind the scenes, scammers are creating fake purchases using leaked, harvested, or fabricated customer data. Once the item ships and is marked as delivered, the transaction looks legitimate on paper.

The real objective? Manipulation. Brushing scams are designed to boost seller ratings, flood platforms with positive reviews, and push products higher in search results—ultimately distorting marketplace performance metrics and customer trust.

How Do Brushing Scams Work?

Although no two scams are identical, most brushing schemes follow a familiar pattern:

Customer Data Acquisition

Fraudsters collect customer information through data leaks, scraping, phishing, or public sources—or simply make it up.

Fake Account Creation

Multiple buyer accounts are created, often in bulk, to simulate organic shopper activity.

Fake Order Placement

Orders are placed through the platform to generate transaction history and delivery confirmation.

Low-Cost Products

To keep costs down, scammers typically ship inexpensive items like seeds, USB cables, or small trinkets.

Phantom Purchases

The package arrives, even though the recipient never ordered it—creating the illusion of a completed sale.

Fake Reviews

Once the order is closed, glowing reviews are posted to inflate ratings and credibility.

QR Code Variations

Some packages include QR codes that redirect recipients to phishing sites or malicious pages, adding another layer of risk.

Who’s Targeted

Brushing scams don’t just hit one area of the retail ecosystem.

Common targets include:

• Ecommerce retailers, whose sales data, reviews, and brand reputation are manipulated. Amazon brushing scams, for example, have made headlines as scammers attempt to inflate product rankings on large platforms.
• Logistics partners and fulfillment centers, which face unexplained shipping volume and operational strain.

Red Flags for Retailers

Brushing scams often leave subtle patterns that can be spotted if you know what to look for. A brushing scam alert can help protect your brand before serious damage occurs.

Keep an eye out for:

• Sudden spikes in low-value orders from new or one-time customers, often intended to boost ratings rather than generate real revenue.
• Suspicious review behavior, such as repetitive language, overly positive feedback, or reviews posted unusually fast.
• Multiple orders from the same internet protocol (IP) address or source, which may indicate coordinated fraud or automated bots.
• Unexpected sales jump without corresponding marketing campaigns or promotions.
• Customer complaints about receiving packages they never ordered—often a sign of brushing scams in action.
• QR codes or phishing elements included in shipments, potentially targeting sensitive customer information.
• One signal alone may not raise alarms—but when several patterns appear together, it’s usually a sign to investigate further.

What Retailers Should Do to Prevent Brushing Scams

When it comes to how to stop brushing scams, it starts with visibility and strong controls

Strengthen Identity and Account Verification

Better verification reduces the risk of mass fake account creation.

Monitor Order and Review Activity

Behavioral monitoring helps flag anomalies before they distort performance metrics.

Improve Review Moderation

Automated tools paired with human oversight can catch fake reviews early.

Secure Customer Data

Limiting access and monitoring for leaks helps prevent misuse of customer information.

Educate Internal Teams

Fraud, support, and fulfillment teams should know what brushing looks like—and how to respond quickly.

If You’ve Been Affected

If brushing activity is already happening, quick action can help contain the damage:

• Report the issue to the marketplace or platform through seller support or fraud channels.
• Report fraud or abuse internally to ensure tracking and remediation.
• Issue a security advisory if customer trust may be impacted.
• Contact law enforcement, including:
• The Federal Trade Commission (FTC)
• The Federal Bureau of Investigation’s (FBI’s) Internet Crime Complaint Center (IC3)
• Notify the U.S. Postal Inspection Service for shipments tied to stolen or leaked data
• Report the activity to the Better Business Bureau (BBB) to help alert other retailers regarding a brushing scam.
• Protect your return logistics to avoid compounding losses from fraudulent returns.