Brushing Scam

A brushing scam is a deceptive tactic where online sellers or scammers send unsolicited packages to individuals, often using their real names and addresses. At best, these “free gift” deliveries enable senders to create fake “verified purchase” reviews for their products on e-commerce platforms, boosting their rankings and credibility. At worst, they may contain a QR code that can harm the recipient in multiple ways when scanned.  These scams exploit personal data, raise privacy concerns, and may indicate unauthorized access to personal information. Let’s look at the myriad of ways “Brushing” can harm us.

How can Brushing scams Harm Me?

1. Personal Data Theft During Registration: Scammers design the QR code to lead you to a fake website asking for personal information to “register” the item. This information, such as your name, email, phone number, or even payment details, could be harvested for identity theft or sold on the dark web.
2. Introduction of Malware:  The QR code might direct you to a malicious website that automatically installs malware or spyware on your device. This malware could monitor your activity, steal sensitive data like passwords, or even encrypt your files for ransom.
3. Credential Harvesting via Phishing: The linked site may appear to be from a legitimate retailer, prompting you to log in or create an account. By doing so, you might inadvertently provide your username and password, which could give scammers access to your real accounts.
4. Device Exploitation: If you scan the QR code with a vulnerable or outdated device, the site could exploit software vulnerabilities to gain control over your device. This might lead to data breaches, financial theft, or even unauthorized access to connected devices in your home.
5. Financial Fraud through Fake Promotions: The website might offer enticing promotions or giveaways, prompting you to pay for shipping or other small fees. These transactions could be used to steal your credit card details or authorize recurring charges.
6. Legal and Reputation Risks: The QR code could redirect you to illegal content or fraudulent schemes, putting you at risk of legal trouble. If your involvement in the scam is publicized, it could also harm your personal or professional reputation.
7. Exposure to Larger Scam Networks: Scanning the QR code could mark you as an “engaged” target, making you susceptible to follow-up scams. Scammers often share lists of active participants, increasing your exposure to phishing emails, fake calls, or other deceptive tactics.
8. Inadvertent Promotion of the Scam:  If you share the package or its contents (including the QR code) with others, you might unintentionally spread the scam to friends or family. Scammers rely on this kind of organic sharing to reach a broader audience.

If my Business Receives such a Parcel, am I still at Risk?

For a small-to-medium business (SMB), a brushing scam can have several implications:

1. Exploitation of Customer Data: If a brushing scam targets your customers, it could indicate a breach of their personal information stored by your company. This could harm your business’s reputation and raise concerns about how well you protect customer data.
2. Misleading Online Presence: Scammers may use fake verified purchases and glowing reviews to outcompete legitimate SMB products or services. This can dilute trust in your brand and make it harder for your authentic products to stand out.
3.  Increased Risk of Fraud: If your business unknowingly handles or ships items for brushing scams, it might become associated with fraudulent activity. This can lead to regulatory scrutiny and potential loss of customer confidence.
4. Potential Financial Losses: Fraudulent sales tied to brushing scams might affect your inventory tracking and create logistical challenges, potentially leading to losses.
5.  Legal and Compliance Risks: SMBs must comply with privacy and data protection laws. If customer data is compromised, your business could face fines or penalties for not adequately safeguarding that information.

How Can I Protect Myself or my Business from Brushing Scams?

1. Notify Vendors: If you suspect a brushing scam, report it to the e-commerce platforms as a scam delivery.
   • Amazon Brushing Report Page
   • Walmart Fraud Alert Page
2. Educate Employees: Train staff to recognize signs of brushing scams and report anomalies.
3. Monitor Customer Feedback: Regularly check online reviews and flag suspicious ones.
4. Secure Customer Data: Use robust cybersecurity measures to protect your databases and customer private data from breaches.
5. Communicate with Customers: Be transparent about security measures and steps you take to safeguard their information.

Brushing Scam Conclusions:

Brushing scams pose significant risks to individuals and businesses, from personal data theft and malware to damaged reputations and financial losses. By understanding how these scams work and the harm they can cause, you’re better prepared to defend yourself and your business. Implementing robust cybersecurity measures, educating employees, and securing customer data are key steps to mitigating these threats. Whether it’s protecting your online presence or reporting suspicious activity, awareness and proactive measures are your best defenses. Remember, becoming more aware means you are becoming more secure.