Better Business Bureau Warns Mobile Area Residents of ‘Brushing’ Scam

The Better Business Bureau is sounding the alarm on a new scam sweeping the Mobile area, and the warning comes with an unusual twist: the victims receive merchandise they never ordered. The scheme, known as a “brushing” scam, involves boxes of unrequested products from Amazon or other online retailers showing up on residents’ doorsteps. While it may look like a windfall, the BBB says there is a significant downside that puts consumers at risk.

The packages themselves are the bait and the byproduct at once. Recipients across Mobile and South Alabama have reported small boxes arriving with items they never bought — cheap gadgets, household goods, assorted trinkets — addressed to them at their correct home address. There is no invoice, no return label with an explanation, and often no sender name that means anything. The natural first reaction is delight or confusion; the BBB’s message is that either way, the package is a signal that someone out there has your name, your address and your buying history, and is using them.

Monde Donaldson with the BBB’s Mobile office explained how the scheme works. Scammers obtain personal information such as names and addresses, then ship low-cost merchandise to those addresses. The scammer then uses the confirmed shipment to post fake verified-purchase reviews on e-commerce sites, artificially boosting the seller’s ratings and product rankings.

Why Scammers Ship You Free Stuff

The economics of brushing are counterintuitive until you understand how online marketplaces reward volume. A third-party seller trying to make a product visible on a crowded platform needs sales and reviews; the marketplace’s algorithms and “verified purchase” badges reward both. Fake reviews written from accounts with no purchase behind them are filtered out, so the workaround is to create real, trackable transactions — the seller ships lightweight, inexpensive goods to real addresses obtained from leaked or scraped personal data, the package registers as a delivered sale, and the seller then posts glowing five-star reviews against those confirmed shipments. The recipient’s actual experience is irrelevant; the merchandise is a prop.

The result is a review system quietly corrupted at scale. Shoppers rely on verified-purchase reviews to sort through thousands of nearly identical listings, and brushing injects false credibility into exactly that signal. For the platforms, it is a persistent enforcement headache; for the BBB, it is a consumer-protection issue on both ends — the shoppers misled by inflated ratings and the unwitting recipients whose identities are being used as instruments of the fraud.

For consumers, the risks go far beyond an unexpected package. Possession of personal data by unknown third parties opens the door to identity theft, fraudulent accounts and further targeted scams.

The package is best understood as a notification: your personal information is in circulation. Data with your name and address attached has been acquired by someone running a fraud operation, and that same data set can be repurposed — for phishing emails crafted around your real details, for fraudulent account applications, for convincing phone scams that open with facts only a legitimate company would know. The brushing shipment is rarely the end of the abuse; it is often the first visible symptom of a personal-information leak the recipient didn’t know had happened.

The timing of the warning matters too. The BBB is encouraging residents across the Mobile and South Alabama region to stay alert as the holiday shopping season approaches, a prime window for such schemes to intensify. Package volume explodes between late November and December, when households are ordering constantly and an unexpected box on the porch attracts little attention. Scammers exploit that cover: an unordered parcel during peak season reads as a mix-up in someone else’s gift order rather than a red flag.

The holiday window cuts the other way as well. Consumers doing their own online shopping — creating new marketplace accounts, entering card details across unfamiliar retail sites, clicking through social-media ads — expose more personal data during the same weeks, feeding the supply of names and addresses that brushing operations draw from. The BBB’s advice is essentially defensive hygiene for the season: shop with established retailers, be skeptical of deals that arrive by unsolicited email or text, and treat any surprise package as information about where your data has leaked rather than as a gift.

What the BBB Says to Do

The BBB recommends that anyone who receives an unsolicited package change passwords on all online shopping accounts, monitor credit reports for suspicious activity and report the incident to the BBB Scam Tracker at BBB.org/ScamTracker.

Each of the three steps targets a specific risk. Changing passwords on shopping accounts closes the door in case the leaked data included credentials rather than just an address — a common outcome of data breaches, where reused passwords turn a mailing-list leak into an account takeover. Monitoring credit reports catches the downstream damage early: new accounts opened in your name, inquiries you didn’t authorize, balances that aren’t yours. Federal law entitles every consumer to free reports from the three major credit bureaus, and a surprise brushing package is a good reason to pull them. Reporting to the BBB Scam Tracker does the public-interest work: it logs the scheme, maps where it is hitting, and helps the BBB and regulators connect individual reports into a pattern they can warn about and act on.

Consumers should never scan any QR code that accompanies an unexpected package, as it may direct to a phishing site designed to harvest additional personal information.

That QR code warning reflects how the scam has evolved. Some brushing shipments now arrive with stickers or cards featuring quick-response codes — framed as a way to identify the sender, return the item, or claim a gift or reward. Scanning one typically opens a website that asks for logins, card numbers or personal details, completing the data harvest the package started. The safe move is simple: don’t scan codes from packages you didn’t order, and don’t follow instructions printed inside them. The merchandise is yours to keep or discard as you wish under most circumstances; nothing about it requires your response.

A National Scheme With Local Consequences

Brushing is not unique to the Gulf Coast — the BBB and federal agencies have tracked the scheme across the country as e-commerce volumes have grown — but its appearance in Mobile follows the pattern the BBB sees everywhere: reports cluster, the local office issues a warning, and the reports serve as an early alert for the region. Donaldson’s office encourages recipients to report even when the package seems harmless, because the aggregate picture is what allows the BBB to identify active operations and warn the next round of targets.

The scheme also thrives on embarrassment and inaction. Many recipients assume an unordered package is simply a retailer’s mistake and throw it away without reporting; others feel vaguely uneasy but see nothing to be done. The BBB’s message pushes back on both impulses: the package is worth a report, the report is quick, and the personal-data implications make it worth taking seriously even when the merchandise inside is trivial.

For older residents — a group the BBB flags repeatedly across its scam warnings — the risks compound. Unsolicited packages can open the door to follow-up phone calls referencing the delivery, and pressure tactics aimed at seniors often start with a plausible-sounding detail the victim recognizes as true. Family members are encouraged to walk older relatives through the basics: real prizes and real orders don’t require payment or personal information by phone, and unexpected packages get reported, not acted upon.

Staying Ahead of the Season

As the holiday shopping season builds toward its peak, the BBB’s practical guidance for the Mobile area boils down to vigilance with a checklist: track your orders so that every box on the porch matches something you actually bought; secure your accounts with strong, unique passwords and two-factor authentication where it’s offered; review credit reports periodically rather than after something goes wrong; and use BBB.org/ScamTracker to check reports from other residents when something feels off.

The broader point behind the brushing warning is one the BBB makes across all of its consumer alerts: personal information is the raw material of modern fraud, and every leak of it — a breach, a scraped database, a phishing email someone answered — becomes the foundation for the next scheme. An unordered box on the doorstep is a small thing, easily dismissed. Read correctly, it is also a warning light on the dashboard: someone has your data, and it is worth spending an afternoon changing passwords and checking your credit before that data is put to worse use.

Residents who receive a suspicious package can report it through BBB.org/ScamTracker, and those who spot charges, accounts or credit activity they don’t recognize are urged to act immediately with their banks and the credit bureaus. The BBB’s Mobile office will continue tracking reports as the season progresses — and the earlier the region’s consumers recognize the scheme for what it is, the less useful their names and addresses become to the people exploiting them.