One million households in the UK potentially hit by Amazon 'brushing' scams

More than one million households in the UK could have been victims of the scam known as 'brushing', Which? research has suggested.

A nationally representative survey of 1,839 people found that 4% of respondents said they or someone in their household received a mystery Amazon package at their home address that they did not order, was not sent by a known person and was not taken in for a neighbour.

The survey results indicate that, when scaled up, 1.1 million households may have been targets of brushing - a marketing scam carried out by unscrupulous Amazon Marketplace sellers, often based in China, to artificially boost their sales volumes and product reviews.

Items received in the mystery parcels included magnetic eyelashes, eyelash serum, toys for pets and children, Bluetooth accessories, iPhone cases, frisbees, medical gloves, and more. These items are cheap to ship in large volumes, which is a hallmark of the scam.

Find out how to avoid fake and dangerous products when shopping online, and how to spot a fake review

What is brushing?

Brushing involves an unscrupulous seller, or an agent acting on behalf of the seller, sending usually cheap-to-ship items to unsuspecting people and then falsely logging it as a genuine sale in order to artificially inflate sales volumes.

As a result, Amazon customers risk being misled into choosing products that aren't as good as they seem.

Brushing is primarily designed to game Amazon's highly competitive search ranking system, which favours products with high sales volumes and good reviews. Because consumers will rarely search beyond the first page or two of product results on the Amazon website, it's important for sellers to appear as high up as possible.

Amazon is aware of brushing and says sellers are prohibited from engaging in the scam. On its website, it advises customers to contact customer service 'immediately' if they receive an unsolicited package. It says it will 'take action [against] bad actors that violate [its] policies'.

Help us make tech giants take responsibility for online harms - sign our petition today.

Which? members report dozens of unwanted Amazon parcels

Getting a free item in the post might not sound like such a bad thing, at first. But some brushing targets receive dozens of unwanted parcels and are left powerless to stop them from arriving, and concerned about who has their address. We spoke to three Which? members who appear to have been brushing targets.

Bath mats and a chocolate mould

When Teresa Martin, a retired teacher from Swindon, began receiving mystery Amazon parcels in October 2020, she assumed they had been wrongly sent to her address - not least because she doesn't shop on Amazon.

When they first arrived she contacted Amazon about the parcels, which were addressed to two people named Moses and Zachary, but still they kept arriving, sometimes more than one a day. Moreover, Amazon didn't appear 'bothered at all,' she says, and told her to keep the parcels or dispose of them as she pleased.

Martin searched for their names online, and in neighbourhood groups, with the hope of sending the parcels on to their intended recipients, but neither seemed to exist.

'The two names to me were old biblical names and that just struck as very odd,' she said.

With no answers from Amazon, she began to grow concerned about why her address had been targeted and whether she was the victim of an elaborate scam.

She got in touch with the local police and then Action Fraud, though neither investigated the issue. And still the parcels - 50 of them in total - kept coming.

'They were all odd cheap things, nothing particularly useful,' she told Which?

'We had a Bluetooth wireless karaoke microphone for children, a bath mat, an electronic target shooting game, food tongs, cycling gloves for children, resistance bands, coasters, Christmas lights, sticky fly traps, a webcam, gaming headphones, two lots of false eyelashes, eyeliner, watch straps, two LED ceiling lights, a bike pump, earbuds, another bath mat, a large electronic soap dispenser, electric lady's shaver, running gloves, thermal gloves, face masks, gift wrapping paper, bows, facial brushes, chocolate moulds, toys, toothbrush heads, headphones, a glass teapot, shower hose, iPhone protectors, a shaver for men - all sorts of odd things. We just took them to a charity shop as soon as we were able to.'

She received the last parcel, the chocolate mould, in May - and never did find out from Amazon what was going on.

Purple fairy lights and men's t-shirts

Matthew, from Salisbury, had a similar experience. He received 13 parcels addressed to a Summer McArthur, who he was never able to track down, despite checking online and asking local neighbourhood groups. He also ruled out that Summer could ever have been a previous resident, as he knew the ownership of the property stretching back to the 1930s.

'It started [around] early December 2020, around the Christmas period,' he told Which?

'I was waiting for Summer to complain to Amazon about her parcels not having arrived. My address and postcode was fine but the name was wrong. It's sort of strange, and then when they keep coming you get concerned a bit. My daughter thought it was some kind of scam.'

Like Teresa Martin, Matthew contacted Amazon and was told to either keep or dispose of the items as he pleased, but he got no answers about what was going on.

As the packages piled up he eventually started opening them to see what was inside - and the variety of items he found inside made him question whether Summer McArthur was a genuine person.

'One arrived when I wasn't at home and that was left and it was an inflatable boxing punch bag,' he told Which? 'I also had several small items of tacky jewellery, some very pretty decorative ribbon with added glitter in three different colours, and some purple fairy lights.'

Matthew also received two black tops, which looked like they were for men, and some electrical conduit, which seemed a 'bit out of character' for the young woman that Matthew assumed Summer to be. Eventually the parcels stopped arriving, but Matthew was left in the dark about why he ever received them.

False eyelashes and a feather duster

Brushing doesn't always involve a false name. Sometimes the parcels are directly addressed to the homeowner, which can leave the target feeling concerned about whether their personal data has been compromised in some way.

John, a retired IT consultant from Somerset, received 20 unsolicited parcels addressed in his name over a six-month period, even though he didn't order any of them.

He got in touch with Amazon three times on the phone, as well as via email and, again, was told to keep, donate, or dispose of them as he pleased.

'We had two wi-fi routers and 10-12 phone covers, most for phones we've never had. We've had false eyelashes, a feather duster [and] a universal car charger,' he said.

'We were concerned because we were receiving items that I could see I hadn't ordered and there was no charge. I just got the feeling at some stage Amazon would [charge me].

'They said as we're not charging you and because it's not a return we can't do anything about it - so basically just keep it.'

How widespread is brushing?

Eric, a marketplace logistics expert based in Shenzhen, China, told Which? that brushing is widespread and 'systematic'.

'The reason for sending out the packages is to feed the Amazon algorithm, the more you sell, the higher your ranking is,' he told Which?

'If you want to pay [for brushing], it's easy,' he said. Asked to comment on the survey findings, he said he was 'not surprised' that our findings indicated brushing could be widespread in the UK, potentially involving millions of parcels.

He believes that Amazon should do more to crack down on brushing to make the platform a level playing field for legitimate sellers.

'Brushing has been going on for at least a decade. The only reason it has now gone wild is because e-commerce has been accelerating very rapidly, especially because of the pandemic.'

David Li, director of Shenzhen Open Innovation Lab, a cross border e-commerce expert, described 'brushing' as seen as simply 'a cost of doing business' for some sellers. He said brushing was widely used as a tactic and that a 'cottage' industry of 'professional service providers who run a network of people with cards' had sprung up to facilitate it.

'In the Amazon universe, brushing is just a cost of doing business very similar to buying ads or getting an 'Amazon certified' logo. Generally, it's a marketing expense,' he said.

'I wouldn't be surprised by the figure. The competition is intensive in cross border e-commerce,' he said of the survey findings. Both experts spoke to us because they said they wanted to see the playing field levelled for legitimate sellers.

Discover why two thirds don't trust tech giants to protect them against either scams, dangerous products or fake reviews.

If I'm a victim of brushing, is my data at risk?

Amazon says sellers find the names and addresses from publicly available sources.

But there are other ways Amazon sellers can access addresses. Eric says that names and addresses are easily collected and 'consolidated' from a variety of sources, including from Amazon itself via its seller platform for merchants, and from a seller's list of customers that it serves on other marketplaces and platforms.

Amazon sellers have two options in terms of logistics: they can either pay Amazon to handle sales for them or they can fulfil orders themselves. It's the second group, he says, who have access to some customer data. We checked, and by viewing invoices, Amazon sellers do appear to have access to customer addresses - though it is not clear how many brushing incidents use such data.

He also suggested that some data could have come from previous unconnected website security breaches. We asked Amazon, and it said brushing scammers use a wide range of external sources, including customer data that's gathered and resold online.

Scott Lester, director of cybersecurity at Red Maple Technologies, urged anyone who had been a victim of brushing not to panic unduly. He said receiving a mystery parcel did not mean someone's personal data had necessarily been compromised online - as many people give away lots of information all the time online without reading the small print.

'The issue is there are almost too many places they could have got this data. Technically, they could just be using a phone book. There are marketing lists that have this kind of information on them. There are places you can sign up and get something for free [and] they provide that service by selling on your data,' he said.

'Most websites that are breached contain email addresses,' he said, rather than an address. However, it's good practice regardless to use strong passwords and two-factor authentication on any online accounts that you do use, for added protection.

Want to stay one step ahead of online scams? Which? can help. Sign up for our scam alert service, and use our scam sharer tool to let us know if you've experienced an online scam.

Amazon's position on brushing scams

Amazon says it has 'robust' processes in place to prevent brushing, which it says are carried out by 'bad actors' using data from 'external sources'. But we want Amazon to do more to increase its scrutiny of seller profiles and monitor for suspicious activity that could suggest product purchases and reviews are not genuine.

Amazon also tells customers they don't need to return the items and can choose to keep the parcels or throw them away, whichever they find more convenient. Some sellers take the brushing scam a step further. They also create a fake Amazon account linked to the unsuspecting recipient's address to 'purchase' the item themselves and then leave a glowing fake review. It is not clear what percentage of 'brushing' scams also lead to a fake review, though sources have suggested that it is fairly common practice.

We asked Amazon how many fake reviews could be connected to brushing and the company didn't say - but it did say it estimates 'less than 0.001% of Amazon orders are impacted by brushing'. It encourages those who have received unsolicited packages to report them to customer services, so that it can investigate fully and take the appropriate actions.

Of the respondents in our survey who did receive a mystery Amazon parcel that they did not order, was not sent by a known person and was not taken in for a neighbour, 63% said they kept them, while 18% threw them away and 16% gave them away.

Our national research follows a separate survey of 12,167 Which? members that indicated 5% of those who responded to the survey may have been brushing targets. Respondents said they were sent a variety of items, including LED strip lights, books, envelopes, sunglasses and headphones. Several described how Amazon told them to keep or dispose of the items, and not to return them - mirroring the advice Amazon gives to brushing scam targets.

Rocio Concha, Which? director of policy and advocacy, said:

'Consumers should be able to trust that the popularity and reviews of products they are buying online are genuine, so it's troubling that third-party sellers appear to be using brushing scams to game Amazon Marketplace.

'Amazon needs to do more to thoroughly investigate instances of brushing scams and take strong action against sellers that are attempting to mislead consumers.

'Which?'s #JustNotBuyingIt campaign is also demanding that strong new laws are introduced by the government to force tech giants to protect people online.'

If you've experienced fake reviews online, or suspect you're part of a brushing scam, email us at fakereviews@which.co.uk