How it works
A seller wants more positive reviews than honest customers will give them. They create order records using real names and addresses they have bought or scraped, then ship a cheap, lightweight item to each one so the purchase shows as completed and shipped.
With a delivery on record, the platform counts any review they post under your name as a verified purchase. You receive an unexpected parcel with no invoice and no clear sender, and somewhere online a five-star review now carries your name.
Why it works and who is targeted
Anyone whose name and address have leaked in a data breach or been sold on can become a target, so it is rarely something you did wrong. The scam works because a free gift feels like good luck rather than a warning, and because the cost of shipping a cheap item is tiny compared with the value of fake credibility.
The people genuinely harmed are other shoppers who trust the inflated ratings, and you indirectly, because the same leaked data can be reused for other fraud later.
Red flags in detail
The clearest sign is a parcel you genuinely did not order arriving with no invoice, no gift note, and often no readable sender. The contents tend to be low-value and random: phone cases, seeds, small gadgets, costume jewellery.
Be especially cautious if the package includes a QR code or a slip inviting you to scan it to find out who sent it. That code can lead to a phishing site, so the harmless parcel can be a doorway to a second, data-stealing stage.
What to do and how to stay safe
You are allowed to keep an unsolicited item and are under no obligation to pay or return it - never pay any fee demanded for it. Do not scan any QR code in the box; instead check whether reviews have been posted under your name and report them to the marketplace.
Change the password of the shopping account linked to your address, turn on two-factor login, and watch your accounts for any orders you did not place. If goods keep arriving, report it to the retailer and to consumer protection.
