No doubt these are strange times we are living in. In fact, so strange that you might have recently received a mysterious parcel in the mail that you didn’t order. These packages often contain hair ties, toothbrushes, cleaning products, or even seeds.
This could be part of an online e-commerce scam called “brushing”.
While receiving small packages in the main might seem harmless, it comes at the cost of your privacy and personal data.
What is brushing?
Brushing involves receiving packages from an online marketplace, for example, Amazon. The seller is usually a third party that uses the websites to sell its products, and the address on the sender label will have their business name.
The seller creates a fake shopper account using your name and address, buys the product from itself, and then sends it to you. People in the US and Australia have reported receiving a number of items in the mail that they haven’t’ ordered. Often this is things that are small and cheap to send, for example, hair ties or seeds.
Why are online sellers sending free items?
In the competitive world of online sales, many businesses are looking to boost their presence and their sales on the platforms. The third-party seller writes a fake, good review of the product it has just “sold” and sent to you, using your name as the author.
Using an actual person’s name makes the review seem more legitimate and helps a seller’s items appear more popular and in demand, according to Damien Manuel, the director of Deakin University’s Cyber Security Research and Innovation Centre told the Age.
“Studies overseas show between 70 and 84 per cent of people make a purchasing decision based on reviews they are reading,” he said.
The Cost Of Free Packages
While this activity can seem nothing to worry about there is a problem with the personal data used to create the sale and the review. It means your name and address been stolen from a data breach.
Personal data is can also be used to access bank accounts or set up new ones, take out loans and steal superannuation, or create fake accounts on social media. It is important to remember that with any online service where you enter your personal details to create an account, it is possible to be open to attacks or data breaches.
Once that data has been stolen, online criminals can sell it to others. This is how ‘brushing’ works, criminals sell your personal details to these third-party retailers, who then send you the packages.
It is important to realise that there are multiple ways that your data may have also been stolen. Other options are through document theft, the hacking of your personal devices, or through phishing, when a scammer fools you into handing over your personal information.
The Rise of Brushing
Brushing is not a new scam, but with the increase in online shopping, it is becoming more common. The Australian Competition and Consumer Commission (ACCC) said there was a 55 per cent increase in people reporting their data stolen this year, compared to the same time last year.
Victims of brushing should report it to the marketplace they received the parcel through, such as Amazon. It is also possible to report it to the seller, but the risk is that they are the ones who stole your data originally.
Organic items like seeds present a biosecurity risk, and anyone who receives them unsolicited in the mail is asked to report it to the Department of Agriculture, Water and Environment on 1800 798 636.
If you think a scammer has your account details, passport, tax file number, licence, Medicare number or other personal identification details, the ACCC says to contact your bank, financial institution, or other relevant agencies. If you would like to know more about how to protect yourself and your data please do not hesitate to get in touch. We are here to help!
