The Brushing Scam

Sometime before, I received a text from an unknown number:

Cod amuont

Goodmorning mam/sir this is [name] from lazada Express PH will attempt to deliver your parcel today! Please keep your lines open so our courier can contact you. If you are not available, please have an authorized representative to receive on your behalf. Prepare the exact amount for COD orders.

Based on the improper English as well as the fact I never ordered anything, I assumed this was a scam. And it was - but not for the reason I thought. Because a few hours later I did receive a package - it contained two dishwashing sponges.

Ok? Maybe someone from my household ordered something?

Nope. I asked everyone. No one bought anything.

But even though I received free sponges, I was still scared - because the person on the other side knew my complete address, phone number, and name. So how did they get these?

Mechanics of the Scam

I started searching for this as it feels like a scam. And apparently, it is one called Brushing. The mechanics are simple:

1. Imagine you are a new seller online for expensive shoes. You know people trust reviews but how do you get your first reviews if no one will buy from a seller without any reviews?
2. You get an idea: You will get addresses from a database with names and contact numbers. You create who knows how many accounts using these information and order from yourself.
3. Now assuming you are using a legitimate platform like Shopee, the order will be created and someone will pick up the order. But you cannot give them the original order right?
4. So you instead send something really cheap. Maybe it’s a rock or a lollipop to give them something for using their information.
5. Once they receive the item, you can now write a review for your store.

In other words, I wasn’t the one being scammed - my information was being used to scam people into believing that the product ratings are legitimate.

I was not harmed financially by this scam (my parents were happy because I received free sponges!). I am still annoyed and mortified by the experience. My personal information had been used without my permission for the simple price of two sponges.

What to do when you get brushed

If you receive an unsolicited package in the mail, there are a few things you can do to protect yourself from the brushing scam:

1. Do not open the package. Yes - I did this but this was a huge mistake on my end. I did not know what was inside and it could have been something dangerous.
2. Report the use of your information to the platform. After knowing about the scam, I immediately called Lazada not because I did not want to receive more sponges but because my personal information was being used. The customer service immediately took action in deactivating the account - requiring only my ID.

By taking these steps, you can help to protect yourself from the brushing scam and prevent other people from being victims as well.

I did not know how these people got ahold of my information. I could only surmise it’s from a data breach, because I did not click on any suspicious links. If this happened, I do not know where it came from. If you know who leaked your details, report them immediately to the National Privacy Commission for a violation of the Data Privacy Act.

Lessons moving forward

From now on though, the experience did teach me a few additional lessons:

1. Be more vigilant about my privacy. Seeing your information being used for something wrong is not a fun feeling. I was already a pretty private person on social media. But after having the experience, I seriously considered getting a PO Box to be used as my address. I did not push through, but it did teach me to share even less personal information online than I already was. I encourage you to do the same.
2. Don’t trust platform reviews online. Look, the amount of bad reviews already on the platforms already alienated me. Like, “Ang bait ng nagdeliver (The delivery driver was nice)” and “Mabilis ang shipping (The shipping was fast)” are not helpful for gauging the product. (I’m not even mentioning those that uses random text to get the free coins). This experience made whatever trust I had in them disappear. Knowing how easily it can be gamed, any review is a 50-50 on being legitimate or illegitimate. Right now, I use reviews from blogs as well as peers to gauge the quality of a product.

I’ll repeat it: I did not lose any money, but I still feel incredibly angry and annoyed by the experience. When I received that actual package, I felt scared because the package listed my full name, address, and contact details. It was question of “what else do they know” kind of deal.

I hope you never experience this - protect your personal details. It is not as fun of an experience as others may believe.