Have you received an unwanted parcel? Here's why you should be worried

Have you ever opened your door and found a parcel you never ordered that is addressed to you?

It may seem like a nice surprise, but these kind of packages - which often contain cheap, low-value items like magnetic eyelashes, pet toys, iPhone cases or frisbees - are a warning sign of a scam known as "brushing".

Up to 1.1 million households in the UK are thought to have had such packages delivered to their door, according to research by Which, that found 4% of respondents had received unwanted parcels.

What is brushing?

Laura Kankaala, TV presenter and Threat Intelligence Lead at F-Secure, told Yahoo News: “It may be a pleasant surprise receiving an unexpected package, however, this could be a scam referred to as ‘brushing’.

“A brushing scam is a fraudulent scheme where scammers use your name and address to manipulate the sales and review systems on popular e-commerce sites, creating a false reputation for sellers.”

So sellers (often based in China) ‘order’ the goods on your behalf, and then file reviews to gain a coveted five-star rating on platforms like Amazon Marketplace.

With cheap, low-value items like phone cases, it’s more than worth the seller’s while to lose the item in order to gain fraudulent reputation.

How do the scammers get your address?

Often scammers target publicly available addresses - such as businesses - but sometimes the information comes from online leaks.

Kankalaa said, “The packages are often sent to publicly available addresses. If this happens, the less disruptive scenario is that scammers will use your information to create fake accounts in your name and order goods that will be delivered to you.

“As the packages are actually sent out, it makes the transaction seem as if it was legitimate, making it possible to write fake reviews online which appear to be "verified"- making their products seem more desirable. There are also other types of brushing scams in which the scammers may contact you—typically by phone—and harass you for payment or returning of the goods or attempt to trick you into providing more personal information.”

But, more worryingly, a ‘brushing’ scam could also be a warning sign that your name and address have leaked online, Kankalaa warned.

Scammers get addresses from multiple sources, including online data leaks, and even invoices for other purchases on Amazon marketplace.

What should you do if you receive a package?

You should immediately report any unwanted packages, Kankalaa advised.

“If you receive an unwanted package the advice is to report it immediately to the platform from which it appears to originate from," Kankalaa said.

“For instance, if the package is from Amazon, report it directly to Amazon. To protect yourself further, check if your home address is publicly available.”

Googling your name can help, or specialist tools to check if your identity has leaked online can also offer reassurance.

Kankalaa said: “It's crucial to report these instances to the relevant shopping platforms. Stay alert and protect your personal information to ensure a safe and trustworthy online shopping environment for everyone.”