Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
The 'brushing' scam that's behind mystery parcels (bbc.com)
166 points by fortran77 on Sept 8, 2020 | hide | past | favorite | 157 comments


> According to Citizens' Advice, if an item is addressed to you, there has been no previous contact with the company, and it arrives out of the blue, then you can keep it.

You might not want to, through. I an was almost-victim of another scam where the scammers opened an account at Best Buy using my information with (someone else's) stolen credit card, and ordered a laptop and shipped it to my address. I returned it to the store immediately and notified Best Buy of the scam, but the next work day a FedEx guy came with a prepaid label (from the scammers) to pick it up. The idea apparently was to confuse me about the return, so I'd accidentally ship the laptop to the scammers rather than Best Buy.

It would've worked too, but I'd already returned the package in person and called the police (because I'd assumed the scammer's plan was to steal it from my doorstep). I didn't realize something was wrong with the pickup until the Fedex guy was almost ready to drive away, but I waved him down to get a look at the label.

The name/address on the was that of a recent immigrant living in New York City. My understanding is that he's probably just a schmuck who got taken in by some fake work from home scam to transship the stolen items. He may even think he's working for Best Buy to process returns.

In any case, I think if I'd kept the laptop I'd have been guilty of receiving stolen property, at least. At worst, I could have been assumed to be a bumbling scammer and charged with credit card fraud (though, being a white professional worker, that probably wouldn't happen since I would probably be given the benefit of the doubt, but other people wouldn't be so lucky).


>> there has been no previous contact with the company

Every law student is given that speech. There used to be a specific scam targeting new lawyers. When a new law office was setup it would be sent books and lawyer-related equipment, along with a bill for payment. The scammers hoped the bill would just be paid without further inquiry. So law students are now warned and told that they can keep such "gifts".

But that isn't how the real world works. Who here doesn't have any previous contact with amazon? What if the package contains something very illegal (drugs etc) and the police are watching it? That will be a fun afternoon. Or what if your new address, previously perhaps a vacant house, is being used by someone buying illegal stuff? Yesterday he would pick it up from the door of an empty house. Today the package is inside the house. Unrequested deliveries should not be treated lightly.


Not sure why previous contact with a company matters?

Here's what the U.S. Federal Trade Commission says about receiving packages you didn't order [1]:

"What do you do when you receive merchandise that you didn’t order? According to the Federal Trade Commission, you don’t have to pay for it. Federal laws prohibit mailing unordered merchandise to consumers and then demanding payment."

There is obvious nuance here [2]. Maybe receiving "stolen property" for example. But if the item is addressed to you, and you didn't order it, I think you're in the clear, and certainly nobody can demand payment and enforce it.

-edit-

This reminds me of the scams in Europe where someone will grab your hand and put a bracelet on or put a flower in your hair or something and demand payment. I've been in this scenario. All you have to do is walk away or just throw the merchandise on the ground. They'll change their tune quickly.

[1] https://www.consumer.ftc.gov/articles/0181-unordered-merchan...

[2] I'm not a lawyer.


In the Pre-Covid Age that scam was pretty common in NYC, too. Usually it's someone dressed as a Buddhist monk in a tourist area like Times Square who will walk up to you and press a charm into your hand, then ask for payment. This happened to me when I first moved here years ago. I wasn't sure what was happening so I thanked him and kept walking, thinking it was some kind of religious proselytizing thing. He came after me and angrily demanded money, so I handed the charm back and left.

Here's an article from a few years ago about these fake monks being a nuisance on the High Line park: https://gothamist.com/news/the-high-line-is-struggling-with-...


My policy is to never take anything from any person on the street. Flyers, comic club tickets, CDs, cans of soda, I don't want the interaction.


It happens in every tourist city, I experienced roses in Paris, bracelets in Madrid, Donations in Berlin.


I had a similar scam happen to me in Istanbul:

A shoeshiner would walk in front of you, 'accidentally' drop their brush. As a decent human you pick it up and hand it to them.

Then the guy insists to give you a 'free' shoe shine. After he's done, he demands payment.

The first time that happened to me, the perpetrator ruined my suede shoes. (I didn't even mind losing the few dollars for the unplanned shine otherwise..) A few days later, on the second time I didn't pick up the brush.


There are different rules for people who have ongoing relationships with companies, mostly so that one party doesn't profit from an obvious mistake.

For instance, say you are a store that orders a 1/2 pallet of coke products every week. Then one week the driver leaves a full pallet by accident. Do you get that extra pallet for free? What if you forget to place the order, but the company for whatever reason sends the usual 1/2 pallet anyway? Should you have to pay for that delivery if you use it? These preexisting relationships create situations different than the mystery package on the doorstep.


You’ll have to look into it some more if you’re interested, but I expect this mostly pertains to Americans receiving mail or packages at their homes.

It may be the case that a supplier who delivers something you didn’t request (in your case here) can’t make you pay, but they’d probably terminate any relationship with you.

So I’m only really going off of what the FTC says. In a case of an existing relationship if Amazon Subscribe and Save sends me an extra unit, then no I don’t have to pay for that. It doesn’t matter if I’ve been buying from them in the past.


UCC - § 2-606. What Constitutes Acceptance of Goods.

"(1) Acceptance of goods occurs when the buyer (c) does any act inconsistent with the seller's ownership; but if such act is wrongful as against the seller it is an acceptance only if ratified by him."

UCC isn't law in every US state, but is common.


Accepted as meeting the seller's obligation under the contract[1]. It's not saying that a buyer incurs new contractual obligations simply by accepting delivery of goods that weren't part of their original contract.

[1] https://www.law.cornell.edu/ucc/2/2-601


The false delivery is offer, making the recipiant a party to the new contract which they acc2pt by taking the goods.


Are you referring to this in an individual customer aspect? Because it seems that the FTC states quite clearly this is not the case. If a company sends you something you didn't ask for and it's addressed to you, you get to keep it as a free gift. The FTC even uses the exact language "free gift".

This may change somewhat if it is a business transaction, but I think it's quite clear if you get a package addressed to you that you didn't order, there's no contractual obligation.

As an example, if you have ever worked in retail sometimes you get truck shipments of things and there can be extra items you didn't order. Maybe the delivery driver said "hey this was sent to you". Accepting delivery of that doesn't mean you have to pay for it.


Business to business transactions have different rules than when an end consumer is involved, usually, because of the asymmetry. Businesses typically have orders of magnitude more cash than the average consumer, so forcing them to lose a few thousand dollars to get their act together is nothing, whereas it could be a disaster for a private person.


Seems like the best option is probably to accept the parcel, then notify the sending company (or authorities, as appropriate) of the problem, and if they request you return it, you can politely say no and cite the law.

I would do this, with the understanding that A) If it's illegal (drugs) or stolen goods, the police should come take it off your hands, and B) while the company in question may not be able to charge you, they might have other ways to "incentivize" you to return it.

E.g. if it's Amazon they might cancel your account and blacklist you. Depending on the value of the item (and how much use you can get out of it), it may be easier to return it than to not use Amazon if you do often, or if you use Prime and/or Prime video/music, or worst case, your name is the main one on the AWS account for your business.

I would gladly return some Google store pixel phone if it meant I didn't have to worry about my Gmail account being locked, and all the problems that would cause me (and yes, this is a good reason for me to have a different email).


I feel like Amazon customer service has been known to be pretty generous about stuff like this. They really want your future business.

I once ordered 5 stools, and they delivered 25. It wasn't a scam, it was a genuine dispatching mistake on Amazon's part. I let them know, and their response was to just keep or "dispose" of the extra stools.

(I ended up donating them to a local piano teacher.)


So many questions...

Did you order 5 piano stools? I have 2 grand pianos, a clavichord, and about 30 electronic keyboards and I still only have 3 piano seats (1 bench, 1 stool, 1 drum throne). So now I have to know what you used those 5 stools for ;)

Second... how long did it take you to find 20 piano stool recipients? And how did you get the message across? Every time I try something like that I get treated like a scam artist and lose interest in helping.


They were normal stackable circular wooden stools, not piano stools. I offered them on Facebook Marketplace and this piano teacher responded saying they needed extra seating for recitals and could use the stools. That seemed the most worthy cause I saw in the first 24 hours so I give away the 20 extra stools to that teacher.

(Incidentally, I do play piano, but the 5 stools I ordered weren't intended for piano use on my part, I was just using them for overflow seating for friend gatherings.)


Ah, thanks for solving that mystery! I can sleep now


Seems like Best Buy would be on the hook. Your address isn't the one associated with the stolen credit card but they accepted it as payment anyway. If the crook marked it as a gift, using the correct address as the payment address and your address as the shipping address, then it does get a bit murky since you were sent an unsolicited "stolen" package. Then it becomes a question of if the laptop is considered stolen or is it considered legally purchased with an illegal credit card transaction. If this was all done with stolen cash, I doubt the laptop would be considered stolen (but I'm not a lawyer so maybe it would be). With a stolen credit card it becomes a much more interesting legal question.

The unwanted bracelet/flower thing happens in South America too though usually with stickers or a small food item like gum or candy. The grifter will hand them out to an entire group and then ask for payment, at which point several people will already have eaten the food item or peeled off the sticker. If you refuse the item or return it in its original state, they usually don't hassle you about it. They rely on the gap of time between handing out the item to the first person and the last person to create an indebtedness that too small for you to make a fuss about paying.


> Seems like Best Buy would be on the hook. Your address isn't the one associated with the stolen credit card but they accepted it as payment anyway.

The funny thing about Best Buy is that they refuse to ship packages to known mail forwarders, even if my card's mailing address matches said mail forwarder.


I find it interesting that receiving unsolicited goods, it's fine to keep them but when unsolicited money appears (due to a bank error or similar), it needs to be paid back.


I guess that's because money is more fungible and doesn't spoil?

And it's also more farfetched to assume that a company would hand out free money without any explanation as swag?


This is not legal advice.

WRT receiving stolen property... typical remedy is to either simply return the item of pay for replacement value.

So, in a worst case, you could probably hold on to it for at least 2 years [1].

[1] - I am not a lawyer. Just someone who has done a lot of legal docs that had to get approved and longtime hobbyist. Anyway, 2 years is the cut off for most civil tort claims but one may want to look into and consider the statute of limitations for conversion as a criminal act.

The 'give and then ask for payment' thing is nothing new. I've had musicians attempt to do so in parking lots in the past, back when CDs were a thing people burned.

Anyway, back to original point... Previous contact could matter THEORETICALLY if it comes to acting in good faith. I.e. if you have a prior relationship with a company, and get an invoice with product and don't even ask the company WTF is up... that COULD be used against you. Would a company do so? IDK. Probably wouldn't be good for PR. Shitty analogy but even the worst Porn Billers do for fraudulent (i.e. customer legitimately paid but balked after) charge backs is typically deny the charge back and blacklist the CC and/or customer.


> Not sure why previous contact with a company matters?

That was mentioned in the article, but the article was from the BBC, so there might be some differences in laws.


I've lost my cool at them a couple times. Then you walk around feeling shitty for the next hour because they're usually poor and/or migrants and probably aren't doing it for fun.

There is another scam I've seen in Australia where companies send out invoices for domains that you own. Except it's an inflated bill from a different company than the domain is currently registered with. Very dodgy.


I've gotten those too. The letters/emails are carefully worded so the subject screams "Pending domain registration!" to make you think it's your actual domain expiring, but the small print says that the service they offer is "registering" your domain in some random "world business directory". This way it's not an outright scam, in that they do render a (completely useless) service in exchange for your money, but of course they hope that the random admin/manager who sees the "bill" won't realize the difference and will pay up.


> scams in Europe where someone will grab your hand and put a bracelet on or put a flower in your hair or something and demand payment

This used to be commonplace in the US, particularly in airports, in the 70s. It's the source of a gag in the movie Airplane (or one of those comedies). I don't know why it faded out.


Probably time, place, and manner regulations for expression in airports.

https://www.lawa.org/news-releases/2002/news-release-5

(very many U.S. airports now have free expression booths requiring a permit, and forbid some kinds of expressive conduct or solicitation elsewhere in the airport, which I think the courts are OK with)


Technically that doesn't say whether you can keep the goods, just whether you can be made to pay for them.


Take a look at the link. But to answer this point:

“ No. If you receive merchandise that you didn’t order, you have a legal right to keep it as a free gift.”


When a new law office was setup it would be sent books and lawyer-related equipment, along with a bill for payment

Not just law offices. EVERY office I ever worked in pre-internet had to deal with this. Almost always it was toner for the copier.

Some of the more clever scammers would call an office and say, "I'm Bill from the copier company. Can you tell me what model of copier we have over there? Oh, and what was your name again?" And when the office drone replied, the scammer would send out hundreds of dollars worth of toner and other supplies, plus an invoice for thousands of dollars, and say that it was authorized, by name, by the person who answered the phone.


> But that isn't how the real world works. Who here doesn't have any previous contact with amazon? What if the package contains something very illegal (drugs etc) and the police are watching it?

That reminds me of a similar scenario: a few years ago the UK enacted a new law (or was about to?) that forced people to decrypt any data they had if the courts asked them to. Burden of proof that they don't have the cryptographic keys was on the person in possession of that data.

So some people who were against this law considered sending some hard disk that might or might not contain encrypted child porn and similar nasties on hard disks to the relevant ministers addresses, report them for possession of dangerous data to the police, and then wish them good luck proving they don't have the keys. (Or, more likely: walking back on the law.)


I question the validity of this advice (and Citizen's Advice's advice) in the UK.

If you're sent something with a bill for payment then it seems to me that you are not entitled to keep it at all because the bill indicates that they are not gifting the items to you but expect payment for them. I.e. property rights have not been transferred.

You can of course keep the items and wait until being asked for them back (and then you obviously don't have to pay for sending them back) but that does not mean that you can keep them as in "they are yours to keep".

According to another comment it seems indeed fine to keep these unordered items in the US by Federal Law, but I don't think this is the case in the UK unless the intent is clear (and, for example, a bill clearly indicates what the intention is).

Edit:

Ah, I stand corrected. There is indeed a law similar to the US's one in the UK:

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013

"(4) In the case of an unsolicited supply of goods, the consumer may, as between the consumer and the trader, use, deal with or dispose of the goods as if they were an unconditional gift to the consumer.”." [1]

[1] https://www.legislation.gov.uk/uksi/2013/3134/regulation/39/...


If the U.K. properly implemented the European directives, if a company sends you something without you requesting it (e.a. Unsolicited) than it’s legally a gift. Even if they add a bill (it’s unsolicited after all).

If they request it back you may send it back with property rights reverting to them (it’s a gift again) but legally there is no way to enforce it nor is there a request to get anything back For it (Ea. Money or other credit)

If there is no contract (Ea a purchase request/ intend) than anything a company Can send to a consumer is a gift.


> If there is no contract (Ea a purchase request/ intend) than anything a company Can send to a consumer is a gift.

I understand that there are restrictions to unsolicited goods, perhaps even a ban.

But an absence of contract does not make something a gift. Whether something is a gift or an offer to purchase or anything else depends on the facts, it's not implied.

So either there is a statute that says this case is legally treated as a gift or the item remain the property of the sender until the intention is clear.

Edit: There is indeed a law that makes it a gift (from EU Directive you mention, perhaps). See my previous comment above. This is indeed required because as explained it cannot be implied.


The directive is an old one making all consumer business laws in the union more or less the same.

The thing that makes it a gift, is that A gift is the only allowed legal transformation that can happen. (Ownerships transfer is a transition in the legal sense). Ea. A company is required to always act lawfully and the only action open for unsolicited (=anything without a predefined base) package is to gift it.

A contract (=agreement to do something in exchange for something else, usually in paper but can be in any form even verbally) is needed before any transformation besides gifting.

This legal sense does not mean it’s still proper to send the package back if the company contacts you and pays for the shipping, but that’s not in law.

The detective I remember reading about during my ‘middle school’ studies (around 1998). I could be mistaken In it and if I am feel free to tell me. All I remember was that the directive made it so that all in the commons market must implement similar protections for Consumers regarding unsolicited mail and package by companies, not in small part to stop the extortion type of sale practice of the “free sample with overpriced subscription” (it’s why they switched to you having to request the sample)


The thing that makes it a gift is that there is a law that explicitly makes it so.

Without such explicit law it wouldn't be a gift because it isn't the intention of the sender. These goods are sent as an offer. If you accept the offer then indeed a contract is formed, but if you refuse the offer then nothing happens, i.e. the goods remain the property of the sender.

That's why they enacted that law, in order to stop the practice altogether in one fell swoop as long as the public is aware of it (which clearly is still not really the case).

The Directive is from 2011. That's the one that was transposed in UK law through the Regulation I mention in a previous comment.


You make it clearer than I said it. Thank you for that. And I learned from you that the U.K. implemented the detective by explicitly making the action a gift, this differs from my country in that regard. (I am always glad to learn something new)


I’m not sure if my experience is unique, but I get so many packages from amazon so often that I don’t even bother looking too closely at the box or even have a clue which delivery might be inside. Someone could easily drop a package at my doorstep and I’ll pick it up and put it in my house without any awareness. Sometimes those packages will go for a while without being opened too, until I realize I need something I ordered. I could easily be holding a brick of cocaine for a while and not know.


Obviously if it's something you don't want, you don't have to keep it.


I have never and likely will never register for an Amazon account. When parcels show up mistakenly (and they do!) with that 'Prime' label I know right away I didn't have anything to do with me. :3

There's a lot of reasons I will never register for an Amazon account; the majority of which are directly related to the treatment of their employees, and if it wasn't that, it would be Amazon's complete unwillingness to do something about the litany of fake products filling it's virtual shelves, or the fake reviews that make it so we can't differentiate between the real product and fake.

I hardly believe I am the only person on Hacker News to have also held out. Seeing Bezo's net value vs. what employees are paid is enough to make it worth going down the road and paying a couple dollars extra.

I remember when COVID first broke out and Amazon refused to cover even sanitizer or masks for their employees, much less any extra compensation for volunteering to help keep the world together in a massive disaster.

Amazon epitomizes the 'slavery with extra steps' phrase from Rick and Morty, and additionally epitomizes the truly horrific nature of inequality of wealth.


Here in the Czech Republic the wages at Amazon aren't so bad. Unlike many other unqualified jobs, they still attract Czech employees and do not have to import cheaper workforce from abroad (Ukraine, Mongolia, Balkan states).

What people find hard to adjust to is the company culture, basically you are a human robot.


Rick and Morty has another one for that, just YouTube 'you pass butter'.


> When parcels show up [...] with that 'Prime' label

Alternatively, it could be that you ordered the product from another seller, e.g. on eBay, who is then using their Amazon Prime subscription as a fulfilment mechanism. (A form of drop-shipping.)


You might want to reconsider your approach to those amazon boxes...

1) Amazon puts 'Prime' labelling on all their parcels, not just ones shipped to Prime members 2) People use Amazon as a way to send people gifts! If I know your address, I could order you something I think you might like from Amazon. They'll even giftwrap it and put in a thoughtful note from me! You don't need an account for that to happen. 3) Because of the ubiquity of Amazon, the world is full of reused Amazon Prime labelled boxes. Maybe your ebay seller is shipping you something in a previously-bought-from-Amazon box.


> the litany of fake products filling it's virtual shelves

Have only had one purchase not be what I expected (over 10 years) and that was quickly returned for a refund.

Amazon employees are not slaves. They can find employment elsewhere. For you to equate them to slaves is so racist that it doesn't belong on HN.


> The name/address on the was that of a recent immigrant living in New York City. My understanding is that he's probably just a schmuck who got taken in by some fake work from home scam to transship the stolen items. He may even think he's working for Best Buy to process returns.

Given I just cleared some quarantines spam from some outgoing mailspools this morning on a hacked account where the spam in question was offering jobs to people to work from home "accepting deliveries, unpacking and checking the contents, and then mailing it on" promising something like $2900/mo (yeah, right), I suspect you're right that it's some random person taken in.


> It would've worked too

I'm not fully following -- how would it have worked? The scammers sent you something, and then issued a FedEx label to pick it back up.

It wasn't your credit card anyway, so ultimately it didn't involve you other than that someone misused your name.

That someone else would have to create a case with their credit card company (and probably win), and you wouldn't be at risk of losing any money either way.

In any case though, if you received something out of the blue, you could probably just be silent, hold onto the item, not answer any e-mails or calls, and even in that case, hang up and call back the law enforcement to make sure you actually are talking to law enforcement.

(I block unscheduled calls anyway, and throw away all unsolicited mail unopened, so they wouldn't reach me anyway.)

That way, either the scammers themselves lose $ (you win and get to keep the item) or the scammers have to call law enforcement (in which case you're innocent and maybe just have to return the item, but the scammers have now exposed themselves to the law).


Weirdly written article. It seemed to start in the US and then sidle off east to the UK.

It kicks off like this:

"It has hit the headlines after thousands of Americans received unsolicited packets of seeds in the mail, but it is not new."

... and then seems to give our American friends advice that is completely useless to them:

Citizen's Advice Bureau (CAB) is a UK setup. Which? is a UK magazine with an attendant "Campaign group". Prof "cyber-security expert at Surrey University" works near London.

This looks like a rather lazy "pally" article. That's a term I've just invented to describe a filler piece that will probably work OK in the UK and US if you don't look too closely. You describe a situation in one country and then fill in with vague waffle that looks reasonable to other similarish jurisdictions.

This sort of nonsense is happening more and more often. Lazy journalism.


Most BBC articles are written with the UK in mind. In this case it gives advice to the UK readers in case they receive unsolicited packages, like the ones they recently reported about in their US section.

I do not see how this is lazy journalism, it's just an article that caters for a UK audience written by a UK media company.


> I think if I'd kept the laptop I'd have been guilty of receiving stolen property

It sounds like the laptop was paid for, but potentially with stolen credit cards? Is that the same as the laptop being considered stolen property?


> It sounds like the laptop was paid for, but potentially with stolen credit cards? Is that the same as the laptop being considered stolen property?

I'm not a lawyer, but that's my logic. The situation definitely wasn't on the up an up, and I'm not taking any legal risk over an $800 laptop I don't want. Morally, I knew who the rightful owner was (Best Buy), so I returned it to them.


> The name/address on the was that of a recent immigrant living in New York City

How did you gather so much information from a shipping label?


> How did you gather so much information from a shipping label?

Google. The name was pretty unique, and I found his wedding website (IIRC). Street view showed the address was pretty clearly a (large) apartment building.

Now that I think about it, it's possible that the name was another stolen identity, but somehow I doubt it.


At first seems wildly overly complicated for a laptop.

But sounds like they're trying to scale up credit card fraud using the layers as buffer


> But sounds like they're trying to scale up credit card fraud using the layers as buffer

Yes, and also discourage law enforcement. AFAIK, $800 is a relatively small potatoes theft. New York is across state lines, and I reported it to the local police (who said the jurisdictional issues would make it a lot more complicated). The only person who's involved that I know of was is a little fish likely was there to take most of the risk to protect the masterminds (and likely doesn't know anything about them, anyway), so going after him probably won't accomplish much, anyway.

My guess is they'll get away with this until the feds get involved.


Most people have to work a week or two to make $1000.


Worldwide, the median annual salary is $3000.


Yeah I was going to say in Nigeria its like $1200 a year - so half makes less than that.


The word median literally means that half make more and half make less, in that context.


no kidding


There is a Book-Parcel scam in India, and I was one of the victims.

When you register a new company, your details are out there in the open, targeted by scammers, spammers, and other marketing specialists. I'm usually paranoid and am good at detecting BS, but this slipped through.

On a fateful day in 2015, while I was driving, the security guard at our building called me to say there is a book order, and the mailman was asking for cash payments. Highly unlikely because I always pre-pay and don't do the Cash-on-Delivery, which is 90%+ of the eCommerce in India.

I had earlier helped the guard's family, especially his daughter (similar to my daughter's age), with some school fees and gifts. So, he is always looking for ways to "repay" me. He offered to pay off the ₹2,500+ for the "official book" order.

In the melee of me driving and the "official book," I told him to go ahead. I paid him the amount he paid the mailman but never told him about the scam lest he feels terrible.

I still have that book-order well packed to remind me of the time when I was scared. I will have it as part of my collectibles (family museum).


There was a similar scam in Italy a few years ago a couple of guys registered (legally/correctly) a travel agency calling it with a name same as of a government agency "Agenzia del Territorio sas" vs. "Agenzia del Territorio" (or something like that).

Then they started sending yellow envelopes with the name stamped in blue (i.e. very similar at first sight to the ones that the actual government agency would send for collecting a fine or similar "official" communication) to firms (names and addresses of firms are public) with a mechanism (again perfectly legal) in which you pay the postman to get the envelope.

The amount was a small one, like 20 Euros or so, i.e. what the porter or a secretary would have available or could advance without asking a manager or even if the manager was called he/she would give the OK since it was an "official" letter.

When the envelope was later opened, it contained a catalog of travels/hotels/etc. with an accompanying letter like

"Dear sirs, following our conversation, please find enclosed the travel catalog you asked for. Best regards." (again perfectly legal stuff).

Almost noone bothered to report to the police the matter, as it would have been difficult to be sure that none of the employees actually ordered the catalog thinking it was free and it would have costed much more in time lost.

So the thing went on for quite a bit of time.


"scammers, spammers, and other marketing specialists"

I like that line for some reason very much. Finally marketing specialists are being named in the right context.


What was the scam? That maybe you forgot you ordered it? Or that since it's a company someone will more likely take possession and pay thinking it's for someone else?


That someone, like the doorman, will just pay it and assume someone ordered it and they'll collect from the someone.

Scammers used to do a similar thing here with xerox/laser toner cartridges.

They'd call ahead and find out what kind of machine you have, and then ship a pallet of the right cartridges for it. Cheap refills, terrible quality, they'd be worth pennies on the dollar compared to the real ones. But, they fit and they print, so the alarm bells aren't ringing yet. Someone else must've ordered these, but they're "the right ones".

Some time later, an invoice shows up. For the amount you'd expect to pay for a pallet of genuine cartridges, which is vastly more than this junk was worth, but does anyone notice? Sometimes, it just gets paid; someone forgot they ordered this, yeah? Whatever, just pay it. Sometimes, this smells fishy enough that it doesn't get paid, and then the scammers call up (sounding like a legitimate office supply firm) concerned about the overdue invoice, and "if you've already opened them then it's not returnable, so yeah, you have to just pay it at this point."

All lies -- it was sent unsolicited, you're under no obligation to pay for it. But a lot of people will, especially if the cold-call weeks ago where they asked about the machine might be vague enough in the memory that, maybe you did agree to buy some?

So the scammers take $600 in product and get $4800 for it. Enough return to make it worthwhile even if quite a few don't fall for it!


I would presume the scam is more or less: ship a cheap book to random company owners with an inflated C.O.D. price, under the assumption that they'll pay for it thinking it's some other package they're expecting.


While we are at this, let us not forget the scam in Roald Dahl's "The Bookseller":

https://en.wikipedia.org/wiki/The_Bookseller_(short_story)

I don't know if it was pure fiction or something like that actually happened that inspired the story.


Maybe the book seller sent several books to different locations expecting that someone would end up paying for it?


It's so strange to me that someone would bother scamming for such a low amount.


I think that is a simple business tactic - low price high volume. For them it is large money, while for the recipient, it was a blip and we would rather not waste time to pursue.

The contents are the worst quality, pretty useless. Imagine a unit production, scamming, failure cost of just 1/10th the success then it is a really good business for them.


There's another scam involving mystery parcels:

The scammer will order a product, to be delivered to your address. Crucially, they use delayed payment.

After delivery, the scammer will come to your door to get the package, claiming a shipping or ordering mistake. As you didn't order it yourself, you'll probably give them the package.

A while later, the store will send you the bill, and they'll harass you until you pay them.


This must not be a US thing. I don't know of any business that ships a product prior to receiving payment.


In the US, if anyone ships you something, you haven't already agreed to pay for it, and it's not illegal in some way or clearly a shipping error... it's yours to keep, legally the same as if they'd explicitly gifted it to you.

This is an intentional feature of the law in order to prevent 'delayed billing' scams of exactly this kind.


Book/CD clubs used to work that way. They shipped you the 'book of the month' and then you'd either return it or pay for it.


Not exactly. They would always send a postcard or something similar beforehand allowing you to opt-out.


These were more like auto-renewing subscription dark patterns if I remember it correctly. You'd get a bunch of books or cd's for $1, but based on the fine print you were really signing up for a subscription where they'd send you one a month from then on at full price. They also of course made it tricky to cancel like any good (read: bad) subscription service does.


Common for business to have an account and net-30 terms meaning that every 30 days you pay off whatever you owe them. Such terms are never offered to consumers only businesses as far as I can tell (but if you pay be credit card you get what amounts to the same thing). Note that the account is setup before you can order, though I have no idea how they verify that it is a real account.


Overly picky nit, Net 30 terms means you have 30 days after being invoiced to pay, it does not mean you get a bill every 30 days. If you order 10 different things on 10 different days, those invoices will be due on 10 different days.

It's entirely up to the company offering credit to determine what kind of due diligence they want to perform before giving another company terms.

If you're some random bozo I've never heard of asking me for quotes for 15K of toner im not going to send you anything unless you wire me money before delivery, more likely I just wont reply at all. (Used to get at least a dozen of these a week)

If you're an account I've been trying to sell into for months, and you finally agree to my meeting, me and the sales manager aren't gonna let the controller fuck this up for us, you can have pretty much whatever terms you ask for.


Such terms are never offered to consumers only businesses as far as I can tell

It happens, but not as often as it used to. For example, in luxury retailing, if you're well-known by the store staff and have a long history with it, it happens. But it's always in the midst of a very high-touch situation.

It also happens with deliveries. Like if you have a regular wine delivery or something like that, and you're an unusually valuable customer, a business will happily send you a bill rather than keep a card on file.


The US probably doesn't have it due to the prevalence of credit cards: those essentially let you order something without actually paying for it as well.

It's not uncommon for stores in The Netherlands to accept delayed payment. Basically, you're able to pay up to 14 days after arrival, without any interest charged.


From the sellers side they're getting paid though with only some risk (and less risk than doing COD and about the same risk as a check or debit transaction).


B2C? no.

B2B? fairly common.


In the US it's called C.O.D. - Collect on Delivery [0]

[0]https://www.ups.com/us/en/shipping/services/value-added/cod....


No it isn't. They still collect payment before actually giving you the package. They just do it at your door.

This scam is apparently about paying after something had been delivered, which most sellers won't offer, and even then only to companies, so it must involve the seller getting scammed too.


> They still collect payment before actually giving you the package.

Yes, but the package is still _shipped_ before payment.


What stores allow you to take delivery of an item without paying for it?


Maybe through Klarna[1]?

[1] https://www.klarna.com/us/what-is-klarna/


In that case you're still establishing the payment agreement before the item is shipped. If you use that service and have the item shipped to some random other person, that other person is under no obligation to pay anything.


That's closer to a credit card than "not paying for it", because the merchant gets immediately reimbursed by the bank, regardless of whether you pay your credit card bills or not. "not paying for it" would be something like NET90 invoicing, where the merchant is extending credit to you directly (by sending you goods and expecting you to pay later). As far as I know, this sort of payment scheme is largely restricted to B2B transactions, and even then, is mostly restricted to big companies.


It's quite common for larger stores in The Netherlands.

Credit cards basically aren't a thing here, so that's probably why they came up with it.


What country are you seeing this in?


The Netherlands


Why does the actual product need to be delivered to the fake reviewers? Surely “Kleinman candles” knows which addresses are fake and can simply not send the candles out to them.

Edit: I'm going to guess because these shady drop-ship companies use FBA and similar?


> Why does the actual product need to be delivered to the fake reviewers?

Because Alibaba, and now Amazon require tracking numbers from sellers.

From time to time they take these tracking numbers, and check them with APIs of shipping companies, and postal services. If a seller has too many invalid tracking numbers, or shipments that don't match the address, they rm -rf him.


But you can ship a packet of flower seeds (cost: 10 cents and a stamp) instead of your expensive product, and your tracking obligation is dealt with.


Congrats, you understand the scam.


Yes, exactly.


Why not check every tracking number when the cost to do so is so low?


Robustness perhaps based upon "fluke" incidents leading to false positives having worse outcomes from being trigger happy on edge cases.


I don't think tracking info APIs are particularly cheap at that scale. If the seller runs in high enough volume there is no need to check every single order to smell fraud.


I'm not so sure. I believe Amazon customers are getting a push notification on their mobile device for every delivery notification, which leads me to believe (at least in the case of Amazon) they have the data.


I'm pretty sure Amazon already does this. I have always received a delivery confirmation straight from Amazon, even for stuff shipped by a third party.


Yeah I am pretty sure Amazon works with most of their shippers because you can usually see all your shipping status information right in Amazon itself without having to leave Amazon to go view it. And like you mentioned there also are delivery notifications.

In fact the shipping company Amazon typically uses in my area takes pictures of their deliveries. So I get an email from the delivery company with a picture, but then Amazon also allows me to view the delivery picture on their site too and notifies me of the picture.

With how much server power Amazon has, I can't imagine them being afraid to make some API calls.


My theory is that a seller wants to set up a legitimate (or legitimate-looking) storefront on Amazon to sell a real (or fake) product in the future.

Rather than build a reputation organically over time by selling real items, they could load up Amazon FBA bins with some cheap items, send them out to real addresses using fake accounts, and then leave fake reviews. When the process is all over, the store looks somewhat legit, since it's sold a bunch of items with great reviews, and the seller can then move on to selling the real (or fake) thing that they actually want to sell.


If I understand the scam correctly, the hypothetical seller "Kleinman candles" is the one performing the scam, in order to create fake reviews. Unless the purpose of the scam is to make the reviewer themself seem more credible.

I just have to wonder ... money has to change hands. Isn't there a cost to doing this, large enough to make it somewhat prohibitive? Even for really cheap items?


I thought so too, unless the item is really cheap. Or (like another poster suggested), it's to build up a reputation for the storefront.

It could be that the seller is simply paying some shady firm to improve their seller reputation. The shady salesman tells the store owner "Give me X dollars and I'll make sure you have a 99% 'good' rating". They take them money, buy a bunch of cheap junk and leave the fake reviews. The store owner may not even know they are fake.


High level ecomm experience w amazon person.

You would think so, but its really not because its a % of goods sale price. FBA merch fee is only 15%. That matters when items are cheap.

So for the cost of COGS + $5 product price *.15% + parcel cost ($4, lower for CN goods dropshipped from abroad). Assuming the good is made for pennies in CN, you are then talking less than $10 for a 5 star review.

Consider CPA in google , FB, or Amazon ("ACOS"), and you start seeing a trend. Keep in mind reviews scale, i.e. adword dollars are spent. Reviews accumulate. They are an asset, not an expense


I want $1M free dollars. I send 1000 packets of seeds with tracking numbers to 1000 random addresses, and then write 1000 fake 5-star "verified purchase" reviews. Total outlay? 1000 x $0.55 postage = $550.00.

I then take my 1000's of five-star review page, and start selling diamond earrings for $199.95. I collect $200k in cash from 1000 sellers who get duped, and never ship anything to anybody ever again.

Repeat x5 and you have $1M free dollars.


Why would you send seeds instead of sending 1000 empty envelopes?


Maybe because you outsource fulfillment to a legitimate company, and they will find it strange to send empty envelopes?

So instead you give them seeds to ship which probably cost less than the envelope itself.


I wonder if package weight is available in the tracking information that Amazon or other seller service can access?


Gotta match the weight of the package to the product weight.


That’s what I don’t get. Maybe if a customer received an empty envelope they would think something is up and report it? By sending a token item the receiver thinks it is a gift? But why not a postcard then which is easier to include?

Part of me wants to think this is an elaborate prank to see what happens when hundreds of people plant mutant seeds.


Wouldn't the cost be more than your hypothetical $550? Since they are buying their own items on Amazon, isn't Amazon still taking a cut from it?

I think this is part of the problem. Amazon still earns money off these fakes. This almost seems similar to the business just buying ads, except I bet this is a cheaper version of ads and is more effective


Uhm wouldn't the 5 star reviews be for seeds? Or is it trivial to change a listing for seeds to diamond earrings?


It's trivial to change the listing on Amazon. I've seen tons of Ship of Theseus listings like this where I'm looking at a reusable bag or a pair of headphones but the reviews are talking about shoes or a book. These listings usually sell genuine product that's cheap or crappy. The scammers usually use generic review text like "Great product! Thanks!" or "Worked great out of the box!" or "Exactly what I needed!"


Minimally the 1000 five-star reviews gives the merchant account credibility as "able to ship a product".

If you can't change the product listing (Seeds2.0, now they're Diamond Earrings!), your "company" at least starts off with 1000 five-star reviews from your other product(s).


I suspect that they actually ship the products in order to look legitimate by providing a valid shipping label/number that can be tracked through a trusted mail carrier service.


yeah but then can’t you send and empty box? or fill it with junk if you need weight?


Isn't that exactly what they're doing? Filling it with junk?


my impression is they are sending people actual items that seem new


Are people actually comparing the items that they received to the items in the fraudulent reviews made using their address? It seems unlikely, so I just assumed they weren't.


Seeds?


as mentioned in the article, and from people i actually know IRL, people are receiving electronics or dog toys etc..


Oh yes, people get all kinds of crap in brushing schemes. Currently, though, tons of people are getting seeds, which people suspect is some sort of large-scale brushing mega-project.


I have yet to see anyone show any evidence that the "mystery seeds" are "brushing"; and it seems like it would necessarily exist, wouldn't it? If there's someone using the fact of the parcels having been delivered as documentation of something, why has no one found an example yet?


I ordered an item a while back that never arrived. Took nearly 3 months arguing with paypal in part because the seller was able to provide tracking information which mapped to a different delivery in the same zip code. Every time this "brushing" scam comes up I wonder if this what they are really doing.


I've gotten epackets containing bows, stickers, and similar low value items that I didn't order (never seeds, though). They came from aliexpress sellers and contained a note saying that the item was a "gift" as a "reward for my business" with a store that I never bought anything from.


I've gotten literally empty ePackets before (long before the recent seeds thing). I assumed they were some kind of Aliexpress scam, but it never hit me personally in any way I could tell other than a few seconds of opening and tossing empty bubble envelopes.


I recommend you to open an AliExpress, and Amazon accounts with the letter a letter exact (including register) address to one from ePacket.

They will detect the duplicate address, and likely give a surprise to the seller.


I guess it might not be, but here’s one we received. Claims to be earrings, contained seeds.

https://imgur.com/a/sRMLbDj


My mom received seeds. I took them and reported the package. Who knows what kind of crap those seeds are and didn't want to test that theory by planting them.


Nina Kollars had a nice related talk during Defcon on a similar scam buying what she thought was gray market Nespresso pods whose "seller" bought for her using a stolen credit card. They also gave her a free Nespresso machine, presumably to give her motive to keep quiet.

https://www.youtube.com/watch?v=2IT2oAzTcvU&ab_channel=DEFCO...


Have had similar in Canada: ordered footwear from a seemingly legit website. Some time later cheap jewellery arrived in the post with the same tracking number and Paypal was duly debited for the cost of the footwear. I reported to PayPal (who promptly refunded) and suggested they shut down or suspend the account, and also the the Canadian Fraud Center (apparently < 5% of people take the time to do this)

https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/eng/0...


"I then set up a load of fake accounts, and I find random names and addresses either from publicly available information or from a leaked database that's doing the rounds from a previous data breach. I order Kleinman Candles from my fake accounts"

Do all these accounts have the same credit card number? I'd think Amazon checks card numbers, so lots of accounts can't use the same card. Or does brushing need getting lots of different card numbers too? I wouldn't think they are so easy to come by in bulk.


The card number problem should be somewhat easy I would think. You either use gift cards or one of the cards out there that lets you create virtual card numbers for online purchases. I would think at some point if you were spinning up hundreds of virtual cards you'd get flagged, but gift cards should be awfully easy other than the time/effort to actually acquire them.


> Or does brushing need getting lots of different card numbers too? I wouldn't think they are so easy to come by in bulk.

Have ever been to those .onion marketplaces?

And somebody bigger will probably employ a service of some rogue bank to issue tons of cards for fake users.

I was surprised that Amazon still allows virtual cards. Alibaba had them blacklisted pretty much from day one.


Brushing scam recipient here. The coolest thing I've gotten so far is a fancy coffee mug. The lamest thing has been a baggie for jewelry (no jewelry included).


They sent me a forehead thermometer (turned out surprisingly useful, hey!), a crappy USB powerbank, and a very compact sleeping bag.

I dismissed the first as a hiccup, but it was weird enough that I took photos of the packaging just in case. When the second arrived, I figured something was up and tried to open an Amazon case, but gave up because the process was frustrating. When the third arrived, I did more research on the scam and persisted enough to open a case, and I think they must've done something because I haven't received any more.

What's odd is that it would be in my short-term interest to have said nothing, and continued receiving interesting goodies. But it's in my long-term interest to have a marketplace I can trust. Will my action lead to that? Fuck no, not until Amazon pulls their head out of their ass.

I'm not holding my breath, and I'm putting a lot more effort into buying things ABA -- Anywhere But Amazon.


My wife has gotten skin cream, hemorrhoid cream, air pod charging cases, a tiny VGA projector, electronic rodent repellers, and countless other items from Amazon in various brushing schemes. Things have slowed down now, but at one point packages arrived almost daily.

Everything was from China and about 75% was packaged to look very similar to more legitimate items being sold.


This was happening in Georgia with people first receiving seeds but then other types of packages were also being delivered to people not requesting them. Pretty much identified as the same type of scam the article related.

* both have video stories attached

https://www.wsbtv.com/news/georgia/get-surprise-package-it-m...

https://www.wsbtv.com/news/local/not-just-seeds-georgians-re...


NPR's podcast Planet Money did a piece on brushing which goes into bit more detail than the BBC article: https://www.npr.org/transcripts/606517326


I want to know the scam behind the rash of SMS message I and many of my friends have gotten recently. The text is different each time, but similar to:

Johnny, urgent alert regarding your USPS shipment 6G55M7 from 03/25/2020. Go to: [url redacted]

For the past couple of weeks I've gotten one of these every day or so, always from a different number. I keep marking them spam, but I doubt that helps if they just keep making up new numbers.

I haven't had the courage to click on the link to see where it goes.

Does the link try to exploit my browser or download malware? Is it just an old fashioned phishing attack?


I've gotten similar ones, except with a local firm instead of USPS, and I live in Sweden.


Yes, it's phishing. It's common enough that it's got its own name: smishing.


My wife keeps getting packages in the mail containing cheap jewelry, the type you’d find in a vending machine for $.25 USD. It’s all very strange.


maybe she has an 8 year old secret admirer


or maybe she is feeding an exceptionally intelligent crow


The sad thing is reputable stores cant counter this chinese seller scam.

Reputable sellers risk being nuked out of the store permanently if they are caught doing this.

Chinese sellers have no rep to speak about (often setting up stores as soon as the other is shut down) so they dont have a risk. They just spend on reviews to pass their stuff as legit

Rinse. Repeat


Here’s one we received earlier this year for your analysis. Personal details were ours including the phone number. The package contained a bag of seeds. Not the rose stud earrings claimed (that we also didn’t order).

https://imgur.com/a/sRMLbDj


My girlfriend gets a random package from Amazon about once a week. The products have not been purchased from her account. When she contacted Amazon they didn't care and just told her to reset her password. We suspect it is this. We either keep the items or donate them.


These scammers are really not thinking this through. They could send out something cheap with their company logo on it, and make it double as advertising.


I think not identifying yourself is a key part of a successful scam


Related to what they reference.

Whatever happened to the whole seed panic? There was so much speculation that made no sense.


Far more likely at the beginning of lockdown people panic bought what they thought were vegetables from amazon grocery but were in fact vegetable seeds from chinese sellers because they didn't read the descriptions fully.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: