Recently, my wife opened a box from Amazon and found a griddle inside. Nice griddle. One problem: She never ordered it. It wasn’t a gift, either. It just showed up.
If that’s ever happened to you, your first reaction is probably a shrug. Free griddle, right? Who’s complaining?
Here’s the catch. That mystery package isn’t a gift from the universe. It’s likely a scam called “brushing” — and the free stuff is the least interesting part of the story.
What ‘brushing’ actually is
Brushing works like this. A shady seller — often an overseas third party, according to the U.S. Postal Inspection Service — creates a fake buyer account using your name and address. Then they “buy” their own product and ship it to you.
Why bother? Because once that package shows as delivered, they can post a glowing “verified purchase” review in your name.
Reviews are everything on Amazon. More five-star reviews mean a higher ranking, more eyeballs, and more sales. So scammers manufacture them by the truckload, using real names and addresses — maybe yours.
Why a free griddle is a red flag
I know what you’re thinking. So what if some sketchy seller writes a fake review under my name? I got a free griddle out of it.
Here’s the problem. For that scam to work, someone had to have your name and your address. And if they’ve got those, what else do they have?
The Federal Trade Commission puts it bluntly: Getting a package you didn’t order means your personal information is floating around out there, probably scraped from a data breach or bought from a data broker.
In other words, the griddle is just the symptom. The disease is that your data is in the wrong hands.
Quick gut-check — if your money advice is coming from random online influencers, you’re playing a dangerous game. I’ve been a CPA since 1981 and writing about money since before the internet existed. Sign up for the free Money Talks Newsletter and get expert advice that’s been tested by time.
The QR code twist you need to watch for
Newer brushing packages come with a nasty bonus: a QR code. The card says something friendly — “Scan to see who sent your gift!” or “Scan for a free prize!”
Don’t scan it.
The Postal Inspection Service warns that these codes can route you to fake websites built to harvest your passwords, banking details, and other personal information. One scan, and a free griddle turns into a drained checking account.
If you want to know where a package came from, check the shipping label or your actual Amazon orders. Never trust a code printed by the same people running the scam.
What to do if a mystery package lands on your doorstep
First, the good news: You get to keep it. By law, unsolicited merchandise is yours — the FTC says you’re under no obligation to pay for it or send it back. Enjoy the griddle.
But don’t stop there. Take these steps to protect yourself:
- Don’t pay a dime: If someone later calls demanding payment for that “gift,” it’s a second scam. Hang up.
- Change your passwords: Update the password on your Amazon account and anywhere else you’ve used the same one.
- Report it: Tell Amazon through its Report Unsolicited Packages or Brushing Scams page, and report the scam to the FTC at reportfraud.ftc.gov.
- Watch your accounts: Keep an eye on your bank and credit card statements, and learn the signs of identity theft before it costs you.
- Freeze your credit: It’s free, it’s federally protected, and it stops crooks from opening new accounts in your name. Here’s how to freeze your credit at all three bureaus.
The bottom line
A surprise package feels like a lucky break. Sometimes it’s just an honest mix-up. But more and more, it’s a warning sign that your personal information has leaked.
So keep the griddle if you want it. Just don’t ignore what it’s telling you. Lock down your accounts, freeze your credit, and treat your data like the valuable thing it is — because the scammers already do.
Add a Comment