/ Money

Beware this new Amazon ‘brushing’ scam

A Which? Money member contacted us when Amazon Prime deliveries they didn’t order turned up on their doorstep. Do you know what a ‘brushing’ scam is? We explain the details.

An Amazon Prime member recently let our Which? Money team know that they’d been sent two items they didn’t order and hadn’t paid for; a carbon monoxide detector and some gaming headphones.

When they called Amazon, they were told that the account used to purchase them wasn’t theirs, and that they were paid for with gift vouchers.

Three days later, they received two more packages – braids and a screen protector – but they refused to accept them. Again the member called Amazon, which put a block on the spurious account.

The member then changed their password and ordered a new credit card. No more orders arrived, but why were they sent to them in the first place?

Brushing scams explained

At first glance, receiving packages you haven’t paid for might seem like a great problem to have. But it’s likely to be a new scam known as ‘brushing’.

This type of fraud involves Amazon sellers setting up accounts in a stranger’s name, then sending their products to an unsuspecting recipient.

They then use this account they’ve set up to write fake ‘verified reviews’ in a bid to improve their seller ratings.

In this case, it’s likely that the member’s name and address had been leaked somewhere. We contacted Amazon and it assured us that the member’s genuine account hadn’t been compromised.

With the member’s permission, we also checked their email address on haveibeenpwned.com, a website that tells you whether your data has been part of a breach. In this case, the data had been involved in at least four.

What to do if you’re a victim of ‘brushing’

It’s always good to be cautious where personal data is concerned, so the member was right to report the incident to Amazon, change their password and order a new credit card.

See all our Consumer Rights scams advice

Identity theft is a serious threat as once a criminal has access to your personal information, they can do everything from open an account in your name and run up debt, or use it to get copies of your official documents.

You can read more on what identity theft is and what to do if you think your information has been compromised in our guide.

Have you had free packages turn up in your name? If so, what did you do? Would you report them or keep them?


Comments

I have had a series of Amazon parcels left on my doorstep that I didn’t order – it has been reported to them, but they seem slow to react. The last one (today) was a huge flat-packed chicken shed and it was leaning up against the house when I came home obstructing the doorway. What is frustrating is that Amazon refuse to collect it – I apparently have to ‘dispose of it or donate it’ if I don’t want it. Apparently I can arrange for it to be couriered back to them at their cost – but I have to do the leg work for them in getting it arranged. I know I could just keep it, but I don’t want it – and it looks pretty cheap and nasty anyway! The worse thing has been dealing with Amazon, their disregard for their customers has been breath-taking and I’ve just deleted my account of many years as a sign of my frustration – not that they will notice, but it made me feel better. Slightly off topic as I don’t think it was a brushing scam, but don’t waste your time trying to make them collect anything that you didn’t order should something turn up, as you will be wasting your time.

JLong says:
20 October 2020

I have received two parcels from Amazon over the past couple of days. I reported it to Amazon, and initially I assumed it was a case of brushing. However, I’ve since discovered that money is being debited from my bank account, so I’m actually paying for these unwanted items. I’ve reported this to my bank and they’ve opened a fraud case. Reading others’ comments it seems these brushing activities come in a range of forms, but if it happens to you Be sure to keep a close eye on activity on your bank account!

Excuse the blunt question but how did you manage to contact Amazon?.. thank you!

I managed to make contact by choosing the get us to ring you option in the Help section, and selecting an order I *had* recently made, as a way of establishing preliminary contact. Mine turned out not to be a brush scan (apparently — I’m still very dubious: why would the packing note say it was a gift if the order was genuinely someone else’s order?), and I don’t know what the Amazon agent would have said or done if it had been, but it seemed the only way of opening any kind of conversation.

chewyjap says:
8 November 2020

this has just happened to me. I first learned that orders were on their way to me when I received e-mails from amazon. I hadnt ordered anything so immediatley looked at my account and found no transactions. I realised that the delivery notification was sent to my previously registered e-mail address. I believed this account to be out of use as I hadnt used it for several years. It turns out my account had been activated, and debits made from my current account. This card however was not registered to this old amazon account. Amzon were extremely unhelpful, in fact they practicaly denied what had happened and seemed more concerned about protecting their reputation than ensuring my security. I too will be cancelling my amazon accounts altogether. The scam is avoidable by ensuring all transactions are verified by two part verification codes etc. Obvioulsy this would have a cost implication for them but surely this should be a legal requirement for all online transactions as data breaches are rife and nobody is genuinley secure anymore.

I recieved an unsolicited parcel yesterday. It was delivered by Hermes and had no sender info on it at all- just the Hermes sticker and a label with Chinese lettering on the item. It was a single metal camping-type mug! Im convinced thus is brushing, but it wasn’t through Amazon- maybe EBAY or Wish? It could happen just as easily through other platforms! I’ve changed my passwords and checked my banking- nit sure there’s anything else I can do even if the parcels keep coming??!

Yousay “the member was right to report the incident to Amazon”, but *how* can someone report a brushing scam to Amazon?

I’ve just received a parcel I didn’t order with a packing note saying it’s a gift, and I have now spent 30 minutes trying to find a way to contact Amazon about it. This IS a brushing scam, and I don’t care about donating it, but I do want them to know how I can contact Amazon without an order number… You can’t chat without choosing a specific subject from a list (in which “brushing scam” does not feature) and then a specific order number, and the same with getting them to telephone you. You can’t apparently ring them; I found a number online for Amazon having failed to find one on their site; but it leads only to a recorded message saying they aren’t taking incoming calls any more.

Searching Amazon Help for “brushing scam” returns zero results and there is nothing in the Security section of the site either.

The parcel contains an item (actually two of them) I was looking at on Amazon a couple of days ago, which I find very worrying.

I’ve checked my credit card statement and changed my password, and on haveibeenpwned.com I haven’t been — but I can find no way to report this to Amazon, and thus the scammers will carry on presumably.

I managed to contact Amazon in the end, and when they checked the order number they said that there had been a mix-up: I had been sent someone else’s genuine order.

I still find this odd and not a little creepy: it’s a huge coincidence for me to look at the product, *not* order it, and then receive it next day because someone else had ordered it and it had been allocated to me… How did my simply looking at the product associate me enough with it for an order to be allocated to me? Hmmm…

What I did to contact them was choose the get us to ring you option in the Help section, and selected an order I *had* recently made, as a way of establishing preliminary contact.

Tracy Mason says:
14 November 2020

Hiya I managed to contact them today through chat – you can actually get them to call you from the chat link

Linda says:
4 November 2020

I would like to see websites being banned from asking for personal details like Date Of Birth in order to register with them or buy something from them. All that should be required is year of birth. I always give a false DOB (correct year) because only my bank or the government need my true DOB.

Just received two items today. Feels like they had my name and postcode but not address. It was addressed / delivered to a house a couple of doors down with the same postcode. Nothing pending on my cards and it wasn’t ordered on my account. I have 2FA on my account anyway.

Amazon chat pretty clueless. It’s been escalated and someone will be in touch via email in 48 hours.

Amanda Miller says:
6 November 2020

i love brushing i have been a “victim” of it for ages and love it

Andy G says:
14 November 2020

We’ve had 30+ parcels. Amazon were really slow & unhelpful. Never admitted what happens

Here is a short video about someone who has had a record number of deliveries for products he did not order: https://www.bbc.co.uk/news/av/technology-55117037

Mick says:
2 December 2020

I have received a £600+ Dyson v11 hover I did not order my bank shows no transaction I want to keep it but is it a scam and what are my rights I have not a clue where it is from

Have a look on Amazon and see if you left a glowing review.

Bruce says:
16 December 2020

You might do worse than contact your local police and ask them to register it as lost property. After 6 months it then be yours beyond doubt

Janet Winn says:
7 December 2020

Been getting random items now since Nov 1st not addressed to anyone at my home but have my address on them . Not ordered on my account and I have not paid for any of them. Phoned Amazon 3 times each time been told to keep/ donate / dispose of the useless tat they contain. Told they will investigate but still they come. Have refused to accept where I can catch the delivery person. This appears to be a widespread issue that Amazon appear to have no interest in sorting.

Smith says:
7 December 2020

Just had a parcel from Amazon I didn’t order with no advice note. The rep didn’t even try to investigate – they just confirmed it wasn’t a scam and that I could keep the useless tat. I deleted my amazon account and all my personal info and will check my bank statements for a few weeks just in case. You would think it would be worth their time investigating, but obviously not. Perhaps this company has just got too big and can’t keep people’s personal details safe anymore.

Smith – If the order has been paid for Amazon are unlikely to expend any effort on dealing with the false order. It might have been a product for which Amazon is only the fulfilment agent, not the actual seller. If you get asked to give a review I should ignore it.

Linda Vaile says:
10 December 2020

I haven’t been a victim of the Amazon brushing scam but my boyfriend has been. As he is dyslexic he can’t use a computer so relies in me for some communications. They’ve somehow gotten hold of his address but have used a fake name of a woman. He’s had quite a few things. I got hold of Amazon Customer services and they did their bit but gave me a link to do something from my end. Unfortunately I began having problems with my Outlook account and was asked for the password, which I chose so long ago and won’t seem to have a record of. No emails in or out for some time now. I’m guessing it’s not up to me to cancel my card or change my password, and my boyfriend doesn’t use passwords but has recently opened a bank account for saving.

PHILIP HANNAM says:
14 December 2020

Two weeks ago a scruffy looking man turned up with a parcel and frightened my wife by shouting birthday, ID several times in her face. He was wearing no PPE and kept crowding her space. I then arrived and asked him what he was doing with an Amazon parcel I had not rodered. His English was too poor to make sense of. I was not going to give him any of my personal details plus he had not followed the safe delivery practice of any other people who bring us parcels. ie. ring doorbell, put parcel down nearby and step back away from the door. No demand for ID, Birthdate, lucky number or favourite colour etc.
When I conatcted Amazon they said it was most likely due to delivery of a restricted article……… totally ignoring what I had said about not making any orders through them….

Was the courier DPD by any chance? They have been the worst company for safe deliveries.

A friend of mine had the same experience with an Amazon flex driver, it seems like there isn’t much of a screening process when hiring people. Haven’t looked that the complaints procedure but I wouldn’t be suprised if there wasn’t much of one. Thank you for sharing this, I’ve logged it down as a feedback for the research team.

Hey Which? representatives. Are you sure haveibeenpwned.com is a legitimate site to be advising people to check? I checked both my email addresses on it and immediately received a spate of spam and phishing emails for weeks. It certainly looked like the site or a bot on the site mined my email addresses.

I’ve had this with an Ebay seller this last week. Apparently another method is called “Amazon/ebay arbitrage” where a seller (normally with a well established Ebay shop with lots a good rating) who’s ran out of stock, lists items on ebay he hasn’t got to sell, then once he gets an ebay order, then orders a cheaper product from Amazon (probably with a stolen credit card) using prime delivery, sending it “as a gift”. This way the ebay buyer can complain all they want, but the seller will just say “return the product”, knowing it should be going back to Amazon, but its going back to a safe drop point for the original seller who didn’t even have a product to sell in the first place.

After this, I’m not using Ebay or amazon ever again.

Connie Kiernan says:
23 December 2020

Just looked up the site you say you checked with haveibeenpwned.com but it is a site that charges to guard your passwords ?? How can this show data breaches ?

off topic but hope this helps:
No, Have i been Pawned is a free service to check if your email address has ever been targated where your info has been sold on the dark web. my info was bought after avast forum was hacked in 2014 and this is how these scumbags get your info. your email has not specifically been hacked but a forum or group and even facebook that you had joined had their servers hacked and then all the info will be sold on the dark web including name, email, password etc. i watched a few youtube videos a few years back and lists were being sold for $10 for 1 million account details. over 10 billion accounts have been hacked over the years.

to offer this free service have i been pawned advertise 1pass as a password protector but you dont have to buy it. its just an option. me personally i use 3 different password managers. avast, dashlane (free version available on one device) and also nord pass which comes with my vpn.
i have 8 emails and 2 of them have been pawned. last year i received a email saying they are holding me to ransom and it scarily showed my actual password i used for the avast antivirus forum. they wanted $400 which is scary at first but not actually that dangerous. they threaten you that they will send all your contacts and family all the p0rn sites you had suposedly visited and this is just a scare tactic. they only have your own contact details and not all of your other contacts so never believe these threats. immediately change your password and forget about it. so all i can say is dont use same password for all of your acconts and dont use simple words. use at least ONE capitol and 1 number and a symbol like !ӣ$%/@

entering your email into the have i been pawned website will show 2 different pages.
green- is all clear and your account has never been accesed by anyone but you.
red- your details had been sold and your name is on the breached list. below will show the biggest breaches to date. immediately change your email password and then dont worry anymore.

bobstall says:
7 January 2021

I have been getting random items from amazon for 12 months, each time i report amazon say this wont happen again. and it happens again, amazon tell me to bin the items im sent. I didnt order any of the items sent to me and im never charged for them.
Amazon said there is nothing they can do as it could be someone sending me a gift, i told amazon this is online stalking and i want it stopped they said how can we stop someone sending you gifts ?
I said its online stalking and its coming from your site. Amazon will not tell me who sends the gifts but some gifts are really odd like a rolling pin or some broken christmas lights…. what if im sent handcuffs or an adult toy will amazon look at this as stalking then ???
Im sick of getting unwanted crap and everything im sent comes without an invoice … how very strange is that ?

I’d advise writing into to one of the national newspapers’ consumer problem pages and seeing if they can do anything via the press office. Amazon should take notice if it makes you feel threatened (and I do understand why it would: I felt uncomfortable with just one instance), and if they won’t listen to you, maybe the power of the press might help. (It’s a bit of a shame that Which simply announces that it happens without really explaining what to do or suggesting it might be following up its report and keeping an eye on the situation… unless it has somewhere else on the site.) It also might be worth seeing if there’s any advice on the MoneySavingsExpert site.

I’m sorry to see Which headlining this unproven theory about what’s behind the delivery of unordered items – mostly packs of seeds – from Amazon as though it’s an undisputed fact.

I’ve seen no proof that it’s due to a so-called “brushing scam”, though of course neither have I seen proof that it isn’t.

But a bit of thought would suggest it’s unlikely. These parcels are apparently coming direct from China, not from an Amazon warehouse using the “fulfilled by Amazon” facility. So Amazon will not know if a parcel has been sent or not. So if a supplier wanted to create fake orders in order to post fake reviews, why bother to actually send anything at all – just place the order, mark it as sent, then create the review. The fake customer isn’t going to report that it hasn’t arrived, as they never knew an order has been placed.

Searching through Snopes.com, usually the best place for checking suspected fake news, we find in an article about unsolicited seed package deliveries “Better Business Bureau’s Jane Rupp has another theory. She thinks it could simply be a scam relating to customer reviews, in which companies post low-cost items so they can write fake reviews for their business in a resident’s name.”

So I suspect people, including Which and the BBC, have just been picking up Ms Rupp’s theory and pushing it out as fact without thinking it through.

I understand some of the packages have the sender’s Chinese address on them, so if anyone were interested in doing some proper investigation it ought to be quite possible to get someone to visit them and unearth the true reason for these deliveries.

Craig says:
1 February 2021

Ive just received 2 parcels from amazon that i didnt order. They were delivered by an amazon driver in amazon boxes. Ive contacted them about it and after half an hour talking to someone i gave up. They arent interested. I will probably just close my amazon account if this is how they deal with issues. To say they are the biggest company in the world they are pretty useless really. They are too big to fail now so dont really care.

Dawn Knight says:
29 January 2021

I have been receiving items from Amazon, which I have not ordered,since December.Strange as I do not have an account with Amazon. Managed to contact them. Told to keep the goods or donate to charity. They took my details, confirmed I do not have an account with them. Said that were going to look into this. Not heard anything as yet. Still receiving unwanted items. I am now refusing delivery. Telling the delivery man that I have not ordered these items. Any emails I receive regarding false orders, I have forwarded to: stop-spoofing@amazon.com. Hope this stops real soon.