BALTIMORE — If you receive a package with your name and address that you didn't order during Amazon Prime Day, cybersecurity experts warn it could be a sign your personal information has been compromised.
These mystery deliveries, known as "brushing scams," aren't free gifts but potential indicators of identity theft.
"They send you a package, and you may think, 'Oh, great, I got a free gift. Awesome,'" said Paige Schaffer, CEO of Iris Powered by Generali, a global identity and cyberprotection company.
But Schaffer warns these unsolicited items can come at a significant cost.
"People have the mindset that free stuff is harmless, but it really is a misuse of your identity," Schaffer said.
These scams typically involve third-party sellers who ship products to real addresses to generate verified purchase status, allowing them to post fake five-star reviews using your information.
"What you don't know is how much of your identity has been tampered with," Schaffer said. "If your social security number is out on the web, people then combine all sorts of pieces of your identity to do larger financial damage."
When asked why sellers would spend money shipping free products, Schaffer replied: "You know, it's a numbers game. So if you think about the sheer volume that Amazon has, their costs are probably low per product. It's worth it for them to get a five-star rating, then more people buy a product."
During major shopping events like Prime Day, the high volume of transactions makes it more difficult for Amazon to detect these deceptive practices.
And many mystery packages include QR codes to entice recipients, but scanning them could download malware or direct you to convincing fake websites designed to steal login credentials.
Schaffer recommends several protective measures: "Change your passwords regularly. Use long passwords. Use phrases, don't make them replicable."
She added a special warning for Prime Day shoppers: "When they have these Prime sales, everybody's shopping, and so are the scammers, it's their holiday, so just be vigilant."
Another variation of this scam involves criminals using your name and address to purchase items with stolen payment information, then intercepting the package before delivery.
For additional information on brushing scams and how to avoid them, the U.S. Postal Inspection Service issued an alert earlier this year.
This story was reported by a journalist and has been converted to this platform with the assistance of AI. Our editorial team verifies all reporting on all platforms for fairness and accuracy.