/ Money

Beware this new Amazon ‘brushing’ scam

A Which? Money member contacted us when Amazon Prime deliveries they didn’t order turned up on their doorstep. Do you know what a ‘brushing’ scam is? We explain the details.

An Amazon Prime member recently let our Which? Money team know that they’d been sent two items they didn’t order and hadn’t paid for; a carbon monoxide detector and some gaming headphones.

When they called Amazon, they were told that the account used to purchase them wasn’t theirs, and that they were paid for with gift vouchers.

Three days later, they received two more packages – braids and a screen protector – but they refused to accept them. Again the member called Amazon, which put a block on the spurious account.

The member then changed their password and ordered a new credit card. No more orders arrived, but why were they sent to them in the first place?

Brushing scams explained

At first glance, receiving packages you haven’t paid for might seem like a great problem to have. But it’s likely to be a new scam known as ‘brushing’.

This type of fraud involves Amazon sellers setting up accounts in a stranger’s name, then sending their products to an unsuspecting recipient.

They then use this account they’ve set up to write fake ‘verified reviews’ in a bid to improve their seller ratings.

In this case, it’s likely that the member’s name and address had been leaked somewhere. We contacted Amazon and it assured us that the member’s genuine account hadn’t been compromised.

With the member’s permission, we also checked their email address on haveibeenpwned.com, a website that tells you whether your data has been part of a breach. In this case, the data had been involved in at least four.

What to do if you’re a victim of ‘brushing’

It’s always good to be cautious where personal data is concerned, so the member was right to report the incident to Amazon, change their password and order a new credit card.

See all our Consumer Rights scams advice

Identity theft is a serious threat as once a criminal has access to your personal information, they can do everything from open an account in your name and run up debt, or use it to get copies of your official documents.

You can read more on what identity theft is and what to do if you think your information has been compromised in our guide.

Have you had free packages turn up in your name? If so, what did you do? Would you report them or keep them?

TACB says:
19 October 2020

I have had a series of Amazon parcels left on my doorstep that I didn’t order – it has been reported to them, but they seem slow to react. The last one (today) was a huge flat-packed chicken shed and it was leaning up against the house when I came home obstructing the doorway. What is frustrating is that Amazon refuse to collect it – I apparently have to ‘dispose of it or donate it’ if I don’t want it. Apparently I can arrange for it to be couriered back to them at their cost – but I have to do the leg work for them in getting it arranged. I know I could just keep it, but I don’t want it – and it looks pretty cheap and nasty anyway! The worse thing has been dealing with Amazon, their disregard for their customers has been breath-taking and I’ve just deleted my account of many years as a sign of my frustration – not that they will notice, but it made me feel better. Slightly off topic as I don’t think it was a brushing scam, but don’t waste your time trying to make them collect anything that you didn’t order should something turn up, as you will be wasting your time.

JLong says:
20 October 2020

I have received two parcels from Amazon over the past couple of days. I reported it to Amazon, and initially I assumed it was a case of brushing. However, I’ve since discovered that money is being debited from my bank account, so I’m actually paying for these unwanted items. I’ve reported this to my bank and they’ve opened a fraud case. Reading others’ comments it seems these brushing activities come in a range of forms, but if it happens to you Be sure to keep a close eye on activity on your bank account!

Excuse the blunt question but how did you manage to contact Amazon?.. thank you!

I managed to make contact by choosing the get us to ring you option in the Help section, and selecting an order I *had* recently made, as a way of establishing preliminary contact. Mine turned out not to be a brush scan (apparently — I’m still very dubious: why would the packing note say it was a gift if the order was genuinely someone else’s order?), and I don’t know what the Amazon agent would have said or done if it had been, but it seemed the only way of opening any kind of conversation.

chewyjap says:
8 November 2020

this has just happened to me. I first learned that orders were on their way to me when I received e-mails from amazon. I hadnt ordered anything so immediatley looked at my account and found no transactions. I realised that the delivery notification was sent to my previously registered e-mail address. I believed this account to be out of use as I hadnt used it for several years. It turns out my account had been activated, and debits made from my current account. This card however was not registered to this old amazon account. Amzon were extremely unhelpful, in fact they practicaly denied what had happened and seemed more concerned about protecting their reputation than ensuring my security. I too will be cancelling my amazon accounts altogether. The scam is avoidable by ensuring all transactions are verified by two part verification codes etc. Obvioulsy this would have a cost implication for them but surely this should be a legal requirement for all online transactions as data breaches are rife and nobody is genuinley secure anymore.

Tracey Rangdale says:
25 October 2020

I recieved an unsolicited parcel yesterday. It was delivered by Hermes and had no sender info on it at all- just the Hermes sticker and a label with Chinese lettering on the item. It was a single metal camping-type mug! Im convinced thus is brushing, but it wasn’t through Amazon- maybe EBAY or Wish? It could happen just as easily through other platforms! I’ve changed my passwords and checked my banking- nit sure there’s anything else I can do even if the parcels keep coming??!

Amanda Hopkins says:
25 October 2020

Yousay “the member was right to report the incident to Amazon”, but *how* can someone report a brushing scam to Amazon?

I’ve just received a parcel I didn’t order with a packing note saying it’s a gift, and I have now spent 30 minutes trying to find a way to contact Amazon about it. This IS a brushing scam, and I don’t care about donating it, but I do want them to know how I can contact Amazon without an order number… You can’t chat without choosing a specific subject from a list (in which “brushing scam” does not feature) and then a specific order number, and the same with getting them to telephone you. You can’t apparently ring them; I found a number online for Amazon having failed to find one on their site; but it leads only to a recorded message saying they aren’t taking incoming calls any more.

Searching Amazon Help for “brushing scam” returns zero results and there is nothing in the Security section of the site either.

The parcel contains an item (actually two of them) I was looking at on Amazon a couple of days ago, which I find very worrying.

I’ve checked my credit card statement and changed my password, and on haveibeenpwned.com I haven’t been — but I can find no way to report this to Amazon, and thus the scammers will carry on presumably.

I managed to contact Amazon in the end, and when they checked the order number they said that there had been a mix-up: I had been sent someone else’s genuine order.

I still find this odd and not a little creepy: it’s a huge coincidence for me to look at the product, *not* order it, and then receive it next day because someone else had ordered it and it had been allocated to me… How did my simply looking at the product associate me enough with it for an order to be allocated to me? Hmmm…

What I did to contact them was choose the get us to ring you option in the Help section, and selected an order I *had* recently made, as a way of establishing preliminary contact.

Tracy Mason says:
14 November 2020

Hiya I managed to contact them today through chat – you can actually get them to call you from the chat link

Linda says:
4 November 2020

I would like to see websites being banned from asking for personal details like Date Of Birth in order to register with them or buy something from them. All that should be required is year of birth. I always give a false DOB (correct year) because only my bank or the government need my true DOB.

Just received two items today. Feels like they had my name and postcode but not address. It was addressed / delivered to a house a couple of doors down with the same postcode. Nothing pending on my cards and it wasn’t ordered on my account. I have 2FA on my account anyway.

Amazon chat pretty clueless. It’s been escalated and someone will be in touch via email in 48 hours.

Amanda Miller says:
6 November 2020

i love brushing i have been a “victim” of it for ages and love it

Andy G says:
14 November 2020

We’ve had 30+ parcels. Amazon were really slow & unhelpful. Never admitted what happens