Receive a Package You Didn’t Order? It Could Be This Scam

Scams come in many forms, and they may not always look like scams at first glance. Receiving a package you didn’t order may be strange, but it probably doesn’t sound suspicious. After all, no scammer would give you a free gift – right? But just because you didn’t pay for the product that showed up at your door doesn’t mean it’s not malicious. Scammers keep coming up with clever ways to trick you, and with brushing scams, they start with an unexpected package.

See Brushing Scams with Venkat Margapuri for a complete transcript of the Easy Prey podcast episode.

Venkat Margapuri is an assistant professor of computer science at Villanova University, where his research focuses on how artificial intelligence and image processing can apply to agriculture and healthcare. Even though scams aren’t his research area, they are out there, and it’s good to know about scams in general. Brushing scams especially come up a lot over the holiday season, when people are ordering a lot of packages and may not notice that some of the things they received weren’t things that they ordered.

How Brushing Scams Work

Brushing scams are, essentially, fraudulent ecommerce schemes where a seller sends unordered products to random people. There are a few reasons why they do this. One is so that they have a record of an order so they can write a glorified review of their own product and make it look legitimate. They also want to encourage people to buy more, hoping that if the person who received the product likes it, they will order more in the future. In this way, it is a way to manipulate sales statistics and reviews and make a potentially fake or low-quality product look better and more legitimate.

However, many scammers also combine brushing scams with phishing. You’ve probably bought something before that came with a little slip of paper encouraging you to write a positive review and the seller will send you a gift card. Often, the paper wants you to scan a QR code. QR codes can direct you to any website the creator wants. You may be directed to a website that looks legitimate, but is a copycat designed to steal your login credentials. Or it could ask you for personal details, like your credit card information or even your social security number. You may actually receive that gift card, but consider what you’ve lost in the process. At that point, you’re essentially a victim of identity theft.

The Risks of Brushing Scams

The primary concern with brushing scams is your identity. If you received a package, that means the scammer has your name and address. That means that your information has been compromised somewhere. When a brushing scam combines with phishing, where a scammer can get more of your data, they can steal your identity. Or if they get any of your financial information, they can use that to make additional purchases or steal your money directly.

The fact that you were sent the package itself shows that your information has been compromised.

Venkat Margapuri

Scammers want money. They’re not going to do anything that involves a cost to them if they can’t reasonably expect to make back their investment and then some. The stuff they’re sending you isn’t free – they expect to steal enough from you to pay for it. When you scan that QR code and put in your login information, identity data, or credit card number, the scammer now has a way to recoup their costs. That’s the biggest risk.

These scammers, if they’re giving out free stuff to people … it’s not really free stuff. They want to make sure they recover their money.

Venkat Margapuri

Especially when the scammers ship the packages with Amazon, the fake login screen often has you enter your credit card information to “validate.” The majority of people wouldn’t find one or two small Amazon charges suspicious. Many people make a lot of purchases on Amazon and might not notice some extra. Not everyone reviews their financial statements, either, and even if they did, a $5, $10, or $15 charge might be innocuous. For scammers, this is an advantage. They make money on number of victims instead of amount of theft, and most people don’t notice or dispute such a small loss.

How They Got Your Mailing Address

There are many people search websites out there that have people’s personal information available. If you go onto one of these sites and type any random name, they will give you information about anyone that name matches. Scammers can just get that information.

Many of them will do some research on you, too. Especially if you have a strong online footprint or they can find your LinkedIn profile, they will attempt to send you products that you will actually be interested in or that are relevant to your career. Many people think of scammers as illiterate criminals with nothing better to do, but that’s not true. Often they are very smart people who are just in the wrong business. Some of the key qualities that factor into someone being a scammer are narcissism and psychopathy, not intelligence. They will apply their considerable cleverness to sending you something you would actually be interested in to better set their hooks.

An additional challenge with all scams, not just brushing scams, is that scams are harder to recover from than fraud. With fraud, someone got unauthorized access to your accounts and moved money out. It’s very specific and has some protections. But in a scam, when you’re tricked into giving out your credentials or sending money, you gave it out willingly but under false pretenses. It’s hard to prove fraud or make any kind of claim against the scammer. And people’s response to scams is almost always a victim-blaming response – it’s your fault that you sent it, whether or not the person you sent it to was honest. That’s not true. But it’s still how many people and institutions look at it.

What to Do if You Get a Package You Didn’t Order

If you get a package you didn’t order, chances are good you’ve been targeted with a brushing scam. You should dispose of the package and its contents immediately. A lot of times these packages don’t come with a return label or even a return address to send it back to. To the best of Venkat’s knowledge, you aren’t legally bound to do anything with these packages.

Once you receive these products, you don’t have to return them, and you’re not – at least as far as I know – legally bound to [do] anything.

Venkat Margapuri

The best course of action is to dispose of whatever product is in the package. That is safest. If there is a QR code included, definitely do not scan it. And if the product is technological, like a hard drive, do not plug it in – you don’t know what it contains, and mostly likely it has some sort of virus or spyware that will infect your entire network.

Most of the products shipped this way aren’t useful or are poor quality. It’s not like scammers are shipping out quality crystal glassware or sturdy hiking boots. If they did, you could keep it and use it as long as you could. Technically, you can keep the product if you want to. But Venkat recommends disposing of it just to stay clear of what the scammer wants.

One Experience with Brushing Scams

One person who was targeted by a brushing scam received a book relevant to his career. But the package had enough information for him to contact the shipper. The shipper was a third party, but they had a phone number. He looked it up online, and every post about the number was from people who had received weird packages and weren’t sure why.

Lots of people have good or bad experiences and never post reviews. Dozens of posts about this same phone number meant probably thousands or more packages from this one shipper to random people. On the scammer’s end, using the same account every time like that wasn’t very smart. But it’s good of people to post that kind of information online. It can help people who look avoid getting scammed.

Scams happen, and they are easy to fall for. One of the main reasons people get scammed is overconfidence. A lot of people, especially smart people, think that they’re smart, they’re educated, and they know a lot, so they’re safe from being scammed. They often fall for scams because of overconfidence. Scammers do their research. They may pose as a family member, close friend, or respected colleague. Social media means scammers can know more about you than you think. Be cautious.

One of the main reasons that research shows people get scammed is over-confidence.

Venkat Margapuri

Anyone Can Get Caught in a Scam

There is lots of information about you out there, especially in the era of social media. Sometimes scammers will even make fake websites targeting specific people they plan to target. Any time an unsolicited contact seems even slightly out of character, be suspicious. Your daughter usually texts you, but now she’s contacting you on Facebook Messenger with something urgent? Be suspicious about that.

A common technique for scammers targeting people in the US is to move the conversation off of whatever app it started on and onto WhatsApp. But outside the US, using WhatsApp is the norm. The key is that there’s no particular app or method that is bad – it’s anything out of the ordinary that should be suspicious. It’s important to be aware of geographic perceptions. In the US, it’s easy to say that anyone asking you to pay money to get a job offer is suspicious. But in some countries, you get a job through a recruiter, and recruiters charge fees. And if you’ve been out of work for a while and desperate, it’s much easier to override your own common sense and buy in. The right scam at the right time can get anyone.

When life happens to you and you get into a state of desperation … even the smartest of people just become victims of these scams.

Venkat Margapuri

Advice to Avoid Scams

The same advice that will help you avoid most scams will also help with brushing scams. Any time something seems odd, whether you’ve received an unusual email or a strange package, always stop for a few seconds and think about what’s going on. Reflection helps prevent a lot of scams. Always pause and reflect on what’s really going on.

Reflection is something that really helped prevent a lot of scams.

Venkat Margapuri

Scammers often try to rush things. They know time is of the essence because at some point, you are going to realize it’s a scam. So they want your money as fast as they can get it. They are always trying to rush you into doing what they want. Any time you receive something suspicious, err on the side of caution. Something that’s too good to be true probably is, and very few things in life are free. Exercise caution and stay safe.

You can connect with Venkat Margapuri on LinkedIn.