When Laura Ramos saw an online sale for a popular Australian fashion brand, with items priced as low as $7, it seemed too good to be true.
The Sydney woman ordered about $70 worth of clothing after clicking through a pop-up ad on social media.
"The logos were everywhere, there were exactly the same photos used on the (real) website, and exactly the same items," Ramos said describing the site.
"They basically copied everything but the price."
She ordered the clothing to be shipped to her workplace, but when more than a month went by and the order didn't arrive, she realised the 'sale' had been a scam.
Then, what appeared to be a diamond ring arrived instead, accompanied by a pamphlet with a QR code, which seemed to encourage people to scan for more information.
"I was so shocked because there wasn't any sender, anything I could check or track, and then I went online (and) everyone in [my workplace] office was shocked," she said.
"They were like, 'What is this? Is your boyfriend proposing to you?'"
Ramos knew her partner was not proposing, so she and her colleagues began investigating.
Laura Ramos was mysteriously sent what appeared to be a diamond ring. Source: Supplied / Laura Ramos
According to the video, the rings were not embedded with real diamonds, and the deliveries were an elaborate scheme, with victims being hacked if they scanned the code and input their details.
Ramos said when she previously tried to scan the QR code, it did not work.
She believes the security settings on her iPhone detected the link was suspicious and blocked it.
While she does not have evidence that the same scammers were behind the fake fashion order and the ring, she suspects they are connected as she rarely clicks on unusual links or online sales.
"I'm quite clever for that, I never go into the links or something like that," she said.
"But for this, it's a decision I took to make that purchase. It's quite 'juicy' to go into that website and buy because it's such a great deal. But I never had this problem before."
What is a brushing scam?
The mysterious package Laura received could be a form of 'brushing scam'.
According to cybersecurity site , brushing scams are a type of e-commerce fraud that involves victims being sent packages they never ordered.
The scammers start by obtaining the victims' details, which they can then use to open hundreds of accounts at the online store where they will list their scam products.
Then, they 'buy' their own goods, send them to the victim's address and post fake reviews on their website, to make their scam products appear real.
LifeLock says the key signs of a brushing scam are receiving items you didn't order, with no return address, and then your name showing up on reviews for these products.
If you are targeted in a brushing scam, your personal and financial information could be exposed, putting you at a higher risk of identity theft, according to LifeLock, and you should keep a close eye on your bank accounts for any suspicious activity.
How can you detect online scams?
According to Scamwatch, Australians lost $74 million to online scams last year.
This includes scammers creating fake websites to look like well-known brands or impersonating famous people to give fake recommendations.
Website scams can also include pop-up banners or windows containing fake warnings or error messages that pressure users into taking action.
Scamwatch says warning signs can include:
- Items at considerably lower prices than usual
- Unusual payment methods requested
- An 'urgent' warning or error message
- Vague reviews, or only positive reviews
Ramos said she would advise others to research more before buying so that they don't make the same mistake she did.
"The first stage I think is checking, and double checking the website that you're purchasing from," she said.
"And opening a new window in your searcher and then type these words next to a scam and see if something pops up."
Scamwatch also suggests doing research before paying any money or giving away any personal details.
"Don't rely on reviews written on the website itself - search for independent reviews on other sites," the Scamwatch website says.
"If an offer appears too good to be true, it probably is. Research any investment opportunity fully before investing money."
If you think you have been scammed, contact your bank provider immediately to report it, ask them to stop transactions, and change passwords on all your devices.
If you have cyber security concerns or think your identity has been compromised, contact IDCARE on 1800 595 160.
