Else Beekman
As online shopping continues to thrive, so do the scams that come with it. One such scheme, known as brushing, is causing concern for both shoppers and genuine sellers.
Spain’s National Cybersecurity Institute (INCIBE) describes brushing as a deceptive tactic where third-party sellers send goods to people who never placed an order. These random deliveries are not acts of generosity, they’re part of a ploy to manipulate online reviews and, more importantly, to gain a competitive edge in the crowded world of e-commerce.
How does the brushing scam work?
Here’s how it works: fraudsters set up fake accounts on shopping platforms and place orders using real addresses, often taken from leaked data or generated randomly. Once the package arrives, they write a glowing review under the recipient’s name, making the product and seller look more trustworthy than they are.
The goal is simple: by flooding platforms with positive, fake reviews, scammers boost the visibility of their products and make them appear more popular and reliable to unsuspecting buyers. This can lead to increased sales and higher rankings on marketplaces like Amazon, all based on false feedback.
Cheap items or empty boxes
Cybersecurity consultant Pablo F. Iglesias, CEO of CyberBrainers.com, told Newtral.es that scammers usually send cheap items,sometimes even empty boxes, just to make it seem like a verified customer left a review. This manipulation allows them to game the system and attract real customers.
According to consumer rights group FACUA, many shopping sites only allow reviews from verified purchases. To get around this, scammers must send out the item to someone’s home, even if that person never asked for it.
Where do they get your details?
Your address might have come from a data breach or simply been guessed. And while sometimes a mistaken delivery is just that, a mistake, it’s worth being cautious.
What should you do?
If you get a parcel out of the blue, first check whether it might be a gift or was sent by mistake. If not, you could be part of a brushing scam. Look online to see if a review has been posted in your name.
Retailers like Amazon offer ways to report such incidents. Meanwhile, Spain’s consumer watchdog OCU recommends reporting the fraud to the shopping platform and also filing a police complaint for identity misuse. You should also contact the Spanish Data Protection Agency (AEPD) via their official website or by calling 00 293 183.
Other scams to watch
Back in December 2024, the Guardia Civil warned of another scam where parcels arrived with a QR code inside. Scanning it led victims to fake websites that asked for personal data or triggered malware downloads.
Bottom line: if a package turns up and you weren’t expecting anything, take a moment to investigate before you open it.
‘Reverse Bizum’ scam targets second-hand sellers in Spain