Earlier this month, Alice Mitchell, a writer and podcast producer who lives in Los Angeles, opened an Amazon package filled with unusual items.
At first, she figured there must have been a mix-up and that her roommate had ordered something in her name by mistake. But then the packages continued to arrive. Mitchell, 46, received everything from waterproof socks to a car-cleaning kit to nipple covers — none of which she nor her roommate had ordered.
“It has inconvenienced me because each time it happens I have to call Amazon and sit on hold as they try to figure out how and why I received this package with my name and home address on it,” Mitchell said.
Mitchell wasn’t just inconvenienced; it’s likely she fell victim to an online-shopping scam called “brushing.”
Her confusion and frustration has turned to concern. “It has made me very paranoid about my debit card,” Mitchell said. “I still check my account every day since this started and even deleted my debit card information out of my Amazon account.”
Amazon AMZN, -0.68% was able to confirm that Mitchell was not charged any money for the items in question based on the tracking numbers included with the packages. The company told Mitchell it would attempt to stop the packages and suggested that she donate the items if she indeed didn’t want them. (Amazon did not respond to a request for comment.)
Other consumers across the country have similarly reported receiving dozens of packages or more from Amazon that they never ordered in brushing scams. A New York woman received roughly a dozen packages containing a random assortment of items. And a Massachusetts couple received unwanted packages from Amazon once or twice a week for five months.
Don’t miss: Here’s the worst mistake people make that compromises their online security
Courtesy of Alice Mitchell
What is ‘brushing’?
So-called “brushing” scams tied to Amazon began in the past three years, said Brian Kilcourse, managing partner at consulting firm RSR Research. Retail and security experts believe these scams are a ploy on the part of third-party sellers to improve the number of reviews they have on Amazon for their products.
Here’s how they work: A third-party seller on Amazon will get the name and address of a consumer. They will purchase an item that they will then send to that person, claiming it’s a gift. Amazon’s policy allows the individual who purchases a gift to leave a review for that item, so the third-party seller will leave a fake review after the item ships. The review is listed as a “verified buyer” review, meaning that it’s supposed to have more authority because it’s from someone who actually bought and theoretically used the product.
“By gaming the system through brushing scams and other tactics, these sellers are able to guarantee positive, verified reviews, which can result in higher search listings and greater appeal to potential customers who are weighing their options,” said Matt Wilson, chief information security advisor at BTB Security, a cybersecurity consulting firm.
Other experts have suggested that third-party sellers may not even be after reviews — sales volume alone can boost a product’s ranking in searches on Amazon.
So how concerned should a consumer be if this happens to them?
“Ignorance is not bliss in this case,” Kilcourse said. Ultimately, the main source of concern in a situation like this is how the vendor came by a consumer’s name and address.
In some cases, a consumer may have actually purchased an item in the past from that seller, providing them with access to their name and address. And to some extent, people’s addresses are easily found through basic web searches.
However, being a victim of a “brushing” scam could also indicate something more nefarious. “It can be indicative of some kind of breach of confidentiality or data security,” Kilcourse said. “It’s a low-grade scam, with some pretty potentially serious data privacy considerations.”
Read more: What NOT to buy on Amazon Prime Day
What to do if you’ve fallen victim to “brushing”
For starters, consumers should pay attention to who is actually handling their transactions on sites like Amazon. In many cases, the sale is actually going through a third-party vendor. Kilcourse advises shoppers to buy items that are being shipped by Amazon directly. If a product does not say it is sold and shipped by Amazon, then the item is actually being sold by a third-party vendor.
Because so many third-party sellers offer deals during Prime Day along with the ones Amazon itself is offering, consumers may see an uptick in “brushing” incidents in the weeks and months ahead as third-party sellers look to shore up their online reviews ahead of holiday shopping season, Kilcourse said.
In the event a consumer does receive an unsolicited package, they should notify the retailer immediately, said Monique Becenti, product and channel specialist at SiteLock, an cybersecurity firm. When contacting Amazon or another retailer, Becenti advised going directly to the company’s website to find their contact information rather than relying on information from an email, in case the e-mail in question is also part of a scam.
After notifying the company, Becenti said the consumer should change their password. It’s important to choose a password that’s completely new and does not contain any easy to guess words, numbers or phrases. Alternatively, consumers could consider signing up for a password manager service to further secure their accounts.
Finally, consumers should take steps to protect themselves financially. “They should utilize some sort of credit-monitoring service to make sure they’re not part of a larger data breach they’re not aware,” Becenti said.
Consumers take that advice one step further and freeze their credit to prevent criminals from using their information to open credit cards or other loans.
Add Comment