Investigators believe that third-party sellers on Amazon are buying their own products in order to leave a wonderful five-star review, then using victims’ names and addresses to appear as independent customers.

Scammers find new ways to commit fraudulent acts all the time; it seems like it happens daily. Some of their methods are so sinister they are immediately taken as a threat, while others seem a lot less alarming on the surface.

One newly reported scam looks a lot less like a potentially harmful crime and a whole lot more like a generous friend or family member, but it could be a sign of trouble.

It’s scary because victims may not even know they’re part of something underhanded.  Called a “brushing scam,” box after box of “free” goods show up on their doorsteps, causing them to feel like they just won the lottery instead of being targeted by scammers. One couple found out they were victims of a brushing scam after countless boxes began arriving from Amazon, filled with a seemingly random assortment of items.

The victims are not charged for the items in questions, but also can’t stop the items from being shipped. Scammers engage in this behavior in an effort to make the purchase look genuine and avoid violating Amazon’s terms for reviewing one’s own products.

Again, some people might not think of this as being “victims” of a scam. After all, you’re not being charged for the items, no one has touched your credit card (that you know of), and technically, these items aren’t even stolen since the seller is the one who purchased them. Wouldn’t it be neat if some of those boxes contain some new gadgets?

The reality, though, is being involved in a brushing scam means that someone has gained access to your name, mailing address, and potentially other information. What else are they doing with it? Depending on how they accessed your information, they could be privy to a lot more of your personally identifiable information than you realize.  Other crimes, such as hacking into a retail website where you legitimately placed an order so scammers can get your data, may have led to your information being used in a brushing scam.

If you begin receiving packages that are addressed to you but you did not order, contact the retailer immediately. Then change your passwords on your online accounts, just in case the scammer got your address by hacking an account. If the volume of shipments becomes a problem, such as the case of the victims in Arizona, you can contact the post office for help with holding packages until you can pick them up or otherwise handle the matter.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.