The online marketplace Wish is a platform that connects buyers with third-party merchants, primarily based in low-cost regions. It does not stock inventory itself, meaning merchants list products, set prices, and ship directly to consumers. While the platform hosts a vast array of goods, from inexpensive novelties to electronics and beauty products, its structure has been linked to controversies regarding product quality, safety, and consumer protection. User reviews are mixed; for instance, Trustpilot shows a 4.5-star rating from over 195,000 reviews, while Sitejabber and ProductReview display significantly lower scores of 1.9 and 1.3 stars respectively. A key point from Wish's own terms of service is that merchants are solely responsible for product quality, the accuracy of listings, and the legality and safety of their products.
One specific concern for consumers, not limited to Wish but prevalent in e-commerce, is the phenomenon of receiving unsolicited packages. This can be a sign of a "brushing scam." A brushing scam is a deceptive tactic used by some online sellers to artificially inflate their product ratings and sales. Scammers obtain personal information—often through data breaches—and send unsolicited packages to recipients. This allows them to pose as a verified buyer and write fake positive reviews under the recipient's name, misleading other shoppers and boosting a product's visibility. The unsolicited package is a clear sign that personal information has been compromised. Scammers do not send free items out of kindness; they have an ulterior motive, which can have far-reaching consequences for privacy, security, and financial well-being.
The brushing scam cycle typically involves several steps. It begins with the data harvest, where scammers obtain a person's name, address, and sometimes purchase history from sources like data breaches, online quizzes, or public records. This information is often bought and sold on the dark web. Next, the scammer creates a fake account on a popular e-commerce platform, possibly using a generic or slightly altered version of the recipient's name to avoid suspicion. Then, using this fake account, the scammer places an order for a low-cost item from their own store or an affiliated store. The item is shipped to the victim's address. Finally, once the package is marked as delivered, the scammer writes a glowing review of the product under the victim's name, thereby fraudulently boosting the product's ratings and sales numbers. The merchandise is usually cheap and low-cost to ship, making the scam appear profitable to the perpetrator.
A newer variation of the brushing scam incorporates "quishing," or QR code phishing. Scammers send lightweight, inexpensive items and may include a QR code in the package. When the recipient scans the code, it leads to a legitimate-looking website designed to trick people into revealing sensitive information such as their full name, credit card numbers, and Social Security numbers. The US Postal Service cautions that if you are a victim of a brushing scam, your personal information has been compromised. They advise not to pay or scan any QR codes in the package and to avoid agreeing to pay for items through any other means. If the package contains liquids, seeds, or other suspicious materials, local authorities should be notified.
In the context of marketplaces like Wish, there have been instances where products sold were found to be fake, illegal, or dangerous. In 2021, under pressure from the French government over widespread safety and counterfeit concerns, Google delisted Wish from its search results and app stores in France. Investigations revealed cases where sellers hosted fraudulent stores, leading to situations where customers placed orders for popular, heavily discounted items that either never shipped or were not as advertised. Some users reported receiving items they never ordered, while others were charged for out-of-stock items and found customer service unhelpful. One user stated they had received stickers instead of a wooden puzzle they ordered, and another alleged that Wish advertised using pictures from legitimate products but sent knock-off versions.
For consumers who choose to use such marketplaces, there are safety steps to consider. When shopping on platforms like Wish, it is advisable to vet the seller by choosing merchants with hundreds or thousands of recent sales and a good average rating, and to read both positive and negative reviews for patterns. Using protected payments like credit cards or PayPal can leverage buyer-protection dispute processes. Planning for lengthy shipping, ideally ordering at least a month in advance, is recommended. It is also important to document everything, keeping screenshots of the listing, price, and any promo codes. To protect privacy, limit how much personal information is shared, use a dedicated or masked email address, and consider using an ad-and-tracker blocker. Wish respects the Global Privacy Control (GPC), which can be enabled in browser settings to signal "do not sell/share" automatically.
Regarding unsolicited packages, if an unrecognized package arrives, it is not a lucky day. It may indicate that a criminal enterprise has the recipient's full name and address and considers them a potential target for future scams. Steps to take include not paying, notifying authorities if the package contains suspicious materials, and being cautious of any included QR codes. While receiving a free item might seem harmless, the underlying motive of a brushing scam can lead to privacy breaches and potential future fraud. The legal standpoint is that brushing scams are illegal in the U.S. and many other countries, as they involve fraudulent reviews and misuse of personal data.
Conclusion
The marketplace Wish offers access to a wide range of low-cost products from international sellers, but it is not without risks. Product quality, safety, and merchant responsibility are significant concerns, as highlighted by user experiences and past regulatory actions. A related issue is the brushing scam, where unsolicited packages are sent to recipients to generate fake reviews, indicating a compromise of personal information. This scam often involves cheap items and may include QR codes for phishing. Consumers should be vigilant, avoid scanning codes from unknown packages, and take steps to protect their personal data when shopping online. Using safe payment methods, vetting sellers, and adjusting privacy settings are prudent measures for navigating such platforms.