Your product has legitimate five-star reviews. Your listing ranks well. Then a competitor (or bad actor) starts sending unordered packages to random addresses under fake customer names, posting fake positive reviews to artificially inflate their own product ranking. Your customers see conflicting signals: is the competitor product actually better, or is something off?
This is the brushing scam—and it is a direct threat to e-commerce brand trust. For sellers on Amazon, Walmart, Temu, and other marketplaces, brushing scams cost real reputation damage and erode customer confidence in review authenticity. But behind every brushing scam is a data source: personal information harvested from data breaches and sold through data brokers. Understanding this pipeline and how to disrupt it is critical for protecting your brand.
What Is a Brushing Scam?
A brushing scam is when sellers send unordered packages to random people to fake positive reviews on online marketplaces. Since online stores rank products based on verified purchases and customer reviews, these fake orders boost product rankings and trick real buyers into thinking an item is more popular than it is.
These scams are not harmless. They involve fraudulent data use, false marketing tactics, and potential identity theft. Many victims of the Amazon brushing scam or Walmart brushing scam have no idea how their personal information was obtained.
But why is it called brushing?
The term brushing comes from the idea of “brushing up” a seller’s reputation. By sending out fake orders and writing false reviews, these sellers make their products look more popular than they actually are. This dishonest tactic is meant to manipulate online algorithms and attract more customers.
How Data Brokers Fuel the Brushing Scam Pipeline
Brushing scams would not work without one critical ingredient: access to real personal data. And that data comes from data brokers.
When a data breach occurs, a healthcare provider, retailer, or SaaS platform loses customer records scammers don’t need to hack into systems themselves. Instead, they simply buy the harvested personal information on the open market through data brokers.
Data brokers aggregate and resell personal information for “marketing purposes,” but the same contact lists end up in the hands of scammers. A scammer purchases a list of 10,000 names and addresses at $0.50–$2.00 per record. They then use those addresses to create fake Amazon or Walmart orders, ship cheap items, and post fake reviews. The real person receives an unsolicited package and has no idea their address was used in a fraudulent transaction.
The Data Broker to Scammer Pipeline
- A data breach exposes personal information. Names, addresses, and sometimes phone numbers and email addresses are stolen.
- Data brokers buy the exposed data. They aggregate breach data with other sources and resell it to third parties under the guise of “marketing lists.”
- Scammers purchase these lists in bulk. A brushing scam operator buys thousands of addresses at low cost.
- Fake orders are placed using the stolen addresses. Each order creates a “verified purchase” record in the marketplace algorithm.
- Fake reviews are posted. The marketplace registers the review as coming from a verified buyer, making it rank higher in the algorithm.
- Innocent people receive unwanted packages. Victims have no idea their personal information was used to commit fraud.
- Platforms struggle to detect the scam. Since each fake order appears to come from a unique address, it looks like separate customers making real purchases.
Why Stopping Data Brokers Matters for Your Business
If your e-commerce business is targeted by brushing scams, the root cause is often data broker activity. Scammers rely on data broker ecosystems because the cost of acquiring personal information is low and the risk of detection is minimal.
By removing your business’s customer data and your competitors’ customers’ data from data broker ecosystems, you disrupt the scammer’s ability to execute large-scale brushing campaigns. When personal data is no longer available for purchase on the data broker market, scammers lose their supply of addresses to target.
For e-commerce sellers, data broker removal is not just a consumer privacy issue. It is a competitive security measure that protects your brand from being targeted by fake-review operations.
How Brushing Scams Work?
Brushing scams exploit online shopping platforms to create fake sales records. Here’s how they work:
- A scammer gets access to real customer information (often through data leaks or hacked accounts).
- They create fake orders using the victim’s name and address.
- The seller ships a cheap or random item (sometimes just an empty package) to the victim.
- A fake review is posted under the victim’s name on the shopping platform.
- The product gains higher rankings, making it more visible to real buyers.
Victims often ask, “How did they get my address?” Unfortunately, personal data is bought and sold online, and scammers use it for different types of fraud, including brushing scams.
What to Do If I Receive a Package I Didn’t Order?
If you receive a package and have no idea who sent it, follow these steps:
- Do not open the package if it looks suspicious.
- Check if someone in your household ordered it.
- Do not pay for anything. Brushing scams do not require you to make payments, but scammers may try to trick you into thinking you owe money.
- Report brushing scams to the online store (Amazon, Walmart, or Temu) and to authorities like the FTC (Federal Trade Commission).
- Monitor your accounts for signs of fraud, such as unauthorized purchases.
If you receive a brushing scam QR code, do not scan it. It could be linked to phishing websites or malware.
How to Stop Brushing Scams?
Protecting yourself from brushing scams requires caution and security measures. Here’s what businesses and consumers can do:
- Secure your online accounts. Use strong passwords and enable two-factor authentication.
- Remove personal information from public websites. Scammers often collect data from old data breaches or social media.
- Report brushing scams to shopping platforms and law enforcement.
- Be careful with unsolicited packages. Never scan a QR code brushing scam, as it could be designed to steal personal information.
Businesses should also take action to prevent fraud on their platforms and educate customers about these scams.
Examples of Brushing Scams
Here are some of the most common brushing scams taking place on the internet right now:
USPS Brushing Scam
The USPS brushing scam involves fake packages being delivered through the U.S. Postal Service. Victims report receiving packages labeled “gift” or “free sample” when they never made a purchase.
How to report it
- Contact USPS Postal Inspection Service at 1-877-876-2455.
- Report to the FTC at ReportFraud.ftc.gov.
- Visit identitytheft.gov to check if your personal information has been misused.
- Place a fraud alert on your credit report with Equifax, Experian, or TransUnion.
Bautero Brush Scam
The Bautero brush scam became widely known when customers started receiving mystery beauty products they never ordered.
How to report it
- Contact Amazon or Walmart customer support if the product came from their platform.
- File a complaint with the Better Business Bureau (BBB).
- Report the scam to consumer protection agencies in your state.
- Review your online shopping accounts for unauthorized orders.
QR Code Brushing Scam
Some scammers use QR codes on fake packages to direct victims to fraudulent websites.
How to report it
- Do not scan the QR code.
- Report the suspicious package to the online marketplace it came from.
- Alert cybercrime units or local law enforcement.
- If a scam website loads, close it immediately and clear your browser history.
Temu Brushing Scam
Temu, a fast-growing online shopping platform, has also been linked to brushing scams.
How to report it
- Contact Temu customer support via their website.
- Report the scam to the FTC.
- If the scam involves a stolen identity, file a complaint at identitytheft.gov.
- Consider placing a fraud alert on your credit file if you believe your personal data is at risk.
How Brushing Scams Damage E-Commerce Business Reputation
Brushing scams don’t just affect individuals. They create lasting reputation damage for e-commerce platforms and legitimate sellers competing on the same marketplace.
Fake Reviews Erode Marketplace Trust
When customers see a product with dozens of five-star reviews but suspect some are fake, their confidence in the entire platform drops. Even if your own reviews are authentic, the presence of fake reviews across the marketplace makes customers skeptical of all ratings and rankings.
A 2024 survey found that over 60% of online shoppers distrust product reviews on major marketplaces. Brushing scams accelerate this skepticism. Customers spend more time researching purchases, read negative reviews more carefully, and are more likely to abandon shopping carts when they cannot verify review authenticity.
Legitimate Sellers Lose Ranking Position
Brushing scam operators use fake orders and reviews to artificially boost their products in marketplace algorithms. Legitimate sellers—the ones following marketplace rules and delivering real customer satisfaction—get pushed down the rankings by competitors using fraudulent tactics.
This creates an unfair market where rule-breaking sellers gain visibility and sales volume while honest sellers struggle to compete.
Platform Operators Face Regulatory and Reputation Risk
Marketplaces like Amazon and Walmart face increasing pressure from regulators and consumer advocacy groups to verify review authenticity. Large-scale brushing scam campaigns damage platform credibility and invite regulatory scrutiny.
Platform operators must invest heavily in fraud detection, review verification, and seller vetting to maintain customer trust. When brushing scams go undetected, the platform itself is blamed for poor governance.
Sellers Experience Increased Support and Operational Burden
Sellers targeted by brushing scams face a complex cleanup process:
- Identifying fraudulent reviews. Manually reviewing orders and sales data to spot fake transactions takes time and expertise.
- Reporting to the platform. Most marketplaces require detailed evidence before removing fake reviews, creating a lengthy dispute process.
- Customer communication. Sellers must respond to customer inquiries about the legitimacy of their products and reviews.
- Loss of sales momentum. While disputes are processed, the fake reviews may still appear, damaging conversion rates.
For a small to mid-sized seller, a concentrated brushing attack can cost thousands in lost sales and operational overhead.
The Data Source Problem: Why Traditional Fraud Detection Fails
Most marketplace fraud prevention focuses on detecting fake accounts, unusual order patterns, or suspicious payment methods. But brushing scams evade these controls because they use real personal information—just not from the person who supposedly made the purchase.
A scammer places 100 orders using 100 different addresses from a data broker list. To the marketplace algorithm, these look like 100 separate customers making legitimate purchases. The addresses are real. The ZIP codes match. The shipping addresses are residential and legitimate.
Traditional fraud detection cannot distinguish between a real customer who happened to place an order and a scammer using someone else’s address from a data broker list.
Breaking the Cycle: Data Broker Removal as a Competitive Defense
E-commerce sellers can defend their business and the broader marketplace by removing personal data from data broker ecosystems. When customer information is not available for purchase by scammers, the cost and difficulty of executing brushing campaigns increases dramatically.
By implementing data broker removal programs—either for their own customer bases or as part of a broader marketplace security initiative—sellers and platforms reduce the fuel that powers brushing scams.
How E-Commerce Businesses Can Protect Brand Reputation and Disrupt Brushing Scams
Brushing scams thrive on cheap access to personal data. Brushing scam operators succeed because data is readily available through data broker marketplaces. But e-commerce sellers and platforms can fight back by breaking the data broker pipeline.
PureWL offers Data Privacy Protection (data broker removal + dark web monitoring) to help e-commerce businesses:
- Remove customer data from data broker ecosystems. Once personal information is removed from broker databases, scammers lose the supply chain they depend on for brushing scam operations.
- Monitor the dark web for breached customer data. Early detection of new breaches means faster intervention before scammers can purchase and resell the data.
- Reduce the attack surface for fraudulent activity. By controlling which platforms have access to customer personal information, businesses reduce the likelihood that their customers’ addresses will be used in fake-order schemes.
- Offer privacy protection as a competitive differentiator. E-commerce platforms can brand their own data privacy solution and offer it to sellers and customers, signaling a commitment to protecting against fraud and building trust.
For e-commerce sellers concerned about fake reviews and marketplace manipulation, data broker removal is not just a privacy measure, it is a fraud prevention strategy that protects brand reputation and reduces the risk of becoming a target.
The Bottom Line: Data Brokers Enable Fake Reviews; Removing That Data Protects Your Brand
Brushing scams are more than just a nuisance to consumers. They are a competitive threat to legitimate e-commerce businesses and a reputation risk to marketplace platforms.
The cycle is straightforward: scammers buy personal data from data brokers, use those addresses to create fake orders and fake reviews, and profit from artificial ranking boosts while damaging the broader marketplace.
Breaking this cycle requires attacking the data source. By removing personal information from data broker ecosystems, e-commerce sellers and platforms disrupt the scammer’s supply chain and make fake-review operations significantly more expensive and risky.
For marketplace operators, sellers, and e-commerce platforms in 2025, data privacy and data broker removal are not just compliance obligations. They are competitive security measures that protect brand trust, preserve marketplace integrity, and defend against the growing threat of brushing scams.
Want to protect your e-commerce business from brushing scams and fake-review manipulation? Start by controlling your customer data.