When Justine Mintern received a package in her letterbox, she was initially confused.
She hadn't ordered the item — a ring in a red velvet bag emblazoned with the name of a luxury brand — and it wasn't exactly her style.
"When I initially received it, I thought that maybe I had a secret admirer with really bad taste," the Melbourne resident said.
It was quite quickly clear the "Cartier" ring was fake, and that a friend had not sent it.
Ms Mintern "started to feel a bit creepy about it".
"I discovered that brushing was a thing, and realised that this must be an example of brushing," she said.
Brushing is, put simply, when online retailers send unsolicited items to real people to generate reviews and boost their online presence.
Many of the retailers on sites like eBay and Amazon are third parties using the larger platforms as hosts to sell their wares.
Reviews from real people help these retailers come to the top of searches and make the sellers seem trustworthy.
Retailers do this by using a real name and address — in this case, that of Ms Mintern — to buy an item from their own stores. It then appears to the host website to be a real purchase, so any reviews left after the fact seem more real.
"It's not so much a scam, but more fraud," cybercrime expert Simon Smith said.
"In the sense that they're using your real details to send you something completely useless and small that doesn't cost them anything, really.
"But it's almost like buying a testimonial, buying a review."
Scams 'more serious' in era of mass data breaches
Mr Smith's work often deals with complex criminal cases with serious consequences for the victims.
He said if people received an item as part of an apparent brushing scam, there was no need to panic.
But, he said, it could be a warning sign.
"Because one thing that we can ascertain from this is the fact these criminals, or these people, have actually got your name and address," he said.
"And if that's what they've got, they can do quite a lot of damage with that information."
As the ABC reported in 2020, instances of brushing rose when the pandemic first hit.
Since then, the personal details of millions of Australians have been leaked, including in the massive Optus and Medibank data breaches.
"I think back a few years ago, it probably was more innocent, in the sense that it was just about reviews," Mr Smith said.
"But I would be considering it a lot more serious now, considering the fraud potential, and especially the money-laundering issues that are going on and the scams that are going on at the moment.
"People could actually have their identity and their names being used for crimes they didn't commit."
'Confusing' to know what to do
A post from Ms Mintern in a local social media group was met with comments from other people in her area who had received similar unsolicited items.
Some were the same fake ring, while others had received fake "Burberry" scarves.
When Ms Mintern realised the ring was not real, she said she checked her credit card records and was relieved to find there had been no suspicious transactions.
"It was confusing to know what to do about it, assuming this is a scam," she said.
"And it's confusing to know whether to report it — it's hard to report to the police 'I received a gift that I don't think I'm entitled to'."
Ms Mintern said she was not entirely sure how the sender of the ring had her name and address.
Mr Smith said if he had received something unexpected in the mail, "I would want to know a little bit more information about why I got it and where they got my details from".
"But I think it's a hard one, because it's already after the fact," he said.
He recommended that brushing package recipients report the item to the retailer or the host website.
The federal government's Australian Cyber Security Centre advises people who may have had their data breached to use its Have you been hacked tool and review their account security settings online.
Meanwhile, the ring posted to Ms Mintern is sitting in a drawer in her house.
"And I'm not sure what to do with it," she said.
"I don't know whether I should throw it out or whether I should keep it. It's sort of a mystery item."
She laughed as she added: "There's part of me that kind of hopes that maybe that it's not fake."
More information and help can be found through iDCare and the Office of the Australian Information Commission.
The Australian Competition and Consumer Commission said people on the look-out for retailer profiles inflated by brushing should "search for independent reviews on the seller rather than relying on the reviews on their own website".
"Use secure payment methods such as PayPal or Apple Pay rather than providing your credit card details direct to the seller," a spokesperson said.
