Unordered Package or Brushing Scam: What to Do If You Did Not Buy It

A real package you do not recognize is not automatically proof of a brushing scam, a hacked account, identity theft, or seller fraud. First check whether the parcel is safe to leave in the ordinary workflow, whose exact name and address appear on it, and whether a household member, gift, delayed order, replacement, subscription, sample, or return explains it. Then verify the carrier, merchant, shopping accounts, reviews, and payments through independently reached official channels.

Do not scan an unknown QR code, call a number printed on a suspicious insert, provide a cancellation code, or pay Cash on Delivery, customs, postage, return, or activation fees until the parcel matches a real transaction. A tracking event can confirm transport activity; it cannot authenticate the seller, purchaser, payment, purpose, or contents.

Start with the state the evidence actually shows

The safest route depends on two separate questions:

1. Who is the parcel addressed to? The user, a household or business, a former resident, or another person?
2. What independent transaction or security evidence exists? A known order, no record, an unknown review, an unauthorized login, a charge, or a payment demand?

Do not let one answer decide the other. Your correct name and address on a label show that someone had access to those printed details. They do not show where the data came from or that anyone entered your shopping account. Conversely, an unknown order or login is a security incident even if the parcel later turns out to be a gift.

Several rows can apply at once. For example, an unexplained parcel can include a malicious QR code, and a legitimate COD service can be imitated by an unverified payment demand. Handle the highest-risk branch first, but preserve the other facts.

Leave the ordinary parcel workflow if the item may be unsafe

Do not open an unknown item merely to decide whether it is a scam if it is leaking, powdery, oily, odorous, hot, smoking, swollen, wired, damaged in a suspicious way, or causing symptoms. Move away, keep other people and pets away when that can be done safely, and follow local emergency, fire, police, postal-security, poison-control, or other official instructions. Do not sniff, shake, taste, connect, charge, or test it.

Seeds, soil, insects, live organisms, plants, food, medicine, cosmetics, or other regulated contents can create a different official route even when there is no immediate emergency. In the United States, USDA APHIS says not to plant non-compliant seeds, to report them, and to keep the seeds and packaging intact for inspection. Australia directs reports about unsolicited biosecurity-risk material to its Department of Agriculture, Fisheries and Forestry.

This safety branch does not prove malicious intent. APHIS has also documented an important counterexample: some seed shipments initially believed to be unsolicited had actually been ordered from sites that appeared domestic but shipped from abroad. Safety routing and transaction verification can both be necessary.

Step 1: read the addressee before reading the contents

Record privately:

• the exact name shown;
• the complete address and unit;
• whether the name is current, old, abbreviated, a business name, a household member, a former resident, or a stranger;
• whether another label appears beneath the visible label;
• how and where the parcel was delivered.

If another person is named

A parcel visibly intended for another person is not the same as unsolicited merchandise sent to you. Do not open it, treat it as a free gift, publish the label, use the contents, or decide that you may discard it based on generic online advice. Use the local postal or carrier procedure for a wrong recipient or former resident.

The operational rules differ. Royal Mail explains that it delivers to addresses rather than names and provides a marking-and-return route. Canada Post likewise explains why mail for a former resident may continue to arrive at the address. These are operator-specific examples, not global ownership rules.

If your name and address are correct

Stay in this guide, but do not jump to brushing. Someone may have intentionally selected your address for a gift, replacement, promotion, family order, or return. The printed return address may name a warehouse, consolidator, fulfillment provider, or returns processor rather than the storefront merchant or purchaser.

If your name is right but the street or unit is wrong, the delivery mismatch may dominate. Preserve the label privately and use the carrier's official wrong-delivery route.

Step 2: try to match a legitimate transaction

Ask only people who could reasonably know, through a trusted channel. Do not post the parcel online to crowdsource the sender.

Check for:

1. a household or workplace order placed under another account;
2. a gift, including one sent without a useful gift note;
3. an old, delayed, backordered, canceled, or split shipment;
4. a warranty or recall replacement;
5. a merchant reshipment after a loss, refund, or damage case;
6. a subscription, trial, sample, promotion, loyalty reward, or charity mailing;
7. an order using a different seller, warehouse, marketplace, or fulfillment name;
8. a return or exchange incorrectly routed to your address;
9. an address saved in another person's account with permission;
10. a parcel that belongs to a known order but contains the wrong item.

Search order histories and email receipts using information you already possess, such as the item, merchant name, order reference, date, or delivery address. Do not follow a link or scan a code from the package to perform this check. If an identifiable merchant is involved, reach it through the official app or a web address you found independently.

When a trusted person, official order record, or verified merchant confirms the match, the scam inquiry can stop unless an independent QR, payment, account, or safety concern remains. A confusing shipper name alone is not evidence of fraud.

Step 3: verify transport without treating it as commercial proof

Type the tracking number into the carrier's official site or official app. Avoid search ads, copied tracking pages, QR destinations, short links, and phone numbers printed on a suspicious insert. If you do not know the carrier, compare the logo and identifier cautiously and use the 11Tracking official carrier support directory to reach the carrier's own channel.

A matching carrier record can help establish:

• that the identifier exists;
• which carrier or final-mile operator handled it;
• shipment and delivery dates;
• transport route or status;
• whether the parcel in hand plausibly matches the record.

It does not establish:

• who paid for the order;
• whether the printed sender is the seller;
• whether the order was authorized;
• whether a fake review exists;
• whether the contents match the declaration;
• whether the item is safe or genuine.

The carrier may be able to verify a shipment record or accept a handling report, but privacy, contract, and account limits can prevent it from disclosing a purchaser or economic seller. Do not assume that support must reveal the sender.

If the tracking number is being used as evidence in a dispute over a purchase you actually made, the primary problem is different. Use Is This a Fake or Unrelated Tracking Number? instead of treating the physical parcel as brushing.

Step 4: check for independent account and payment signals

Review the accounts most plausibly connected to the parcel. Start with shopping or marketplace accounts suggested by legitimate evidence; do not reset every account solely because a label has your address.

Check for:

• an order you did not place, including archived, canceled, or family-account orders;
• an unfamiliar review, rating, question, seller message, or support conversation;
• an unknown login, password-reset notice, recovery request, or signed-in device;
• a changed delivery address, phone number, email address, or payment method;
• an email forwarding rule or filter you did not create, when compromise indicators exist;
• a card authorization, bank transaction, wallet payment, gift-card use, reward-points use, or buy-now-pay-later entry;
• a request for a login, password, one-time code, remote access, app installation, or payment.

Name and address only

If the parcel has your correct name and address but there is no unknown order, charge, login, review, account change, QR interaction, or payment demand, the source of the address data remains unknown. Public records, marketing data, previous transactions, data brokers, breached records, and third-party seller data are all possible sources. The parcel does not show which source was used.

Review relevant accounts and statements, strengthen baseline protections, and monitor for new activity. The FTC's current U.S. alert recommends changing online-shopping passwords after an unexpected package. That is protective advice, not proof that a password was used. Full account recovery becomes more clearly necessary when independent unauthorized activity exists.

Unknown review or repeated seller activity

An unknown review, rating, seller message, or repeated unexplained low-value shipment makes review manipulation more plausible. Report the facts to the platform through its official site or app. Preserve the report number and the exact activity you observed. Do not claim that your password, payment method, or identity was stolen unless separate evidence supports that statement.

Unknown order, login, security change, or charge

Treat this as an account or payment incident regardless of whether the parcel fits brushing. Use the affected provider's official recovery process. Current NCSC account-recovery guidance includes changing the affected password, ending unfamiliar sessions, checking recovery details, enabling two-step verification, and reviewing statements when unauthorized activity exists. Change reused credentials on other important accounts as well.

For an unknown card, bank, wallet, gift-card, or financing transaction, contact the relevant provider promptly through its official channel. The payment method controls the available recovery route. Do not file a card dispute merely because a parcel arrived when no card transaction exists.

Identity-theft steps, such as a credit freeze or a formal identity report, should follow evidence of identity misuse or official guidance—not the parcel alone. A package can indicate address-data exposure without proving identity theft.

What brushing means—and what one parcel cannot prove

In a brushing scheme, a seller or other actor creates shipments or apparent orders to make sales, ratings, or reviews look more legitimate. A low-cost item, empty envelope, or other inexpensive shipment can create a transport record that supports the appearance of a real transaction.

The FTC, U.S. Postal Inspection Service, and USPS describe this current pattern. Amazon also maintains a first-party unsolicited-package and brushing report and notes that publicly available names and addresses may be used.

Those sources support the mechanism. A single parcel still does not establish:

• how the sender obtained your data;
• that your marketplace account was accessed;
• that a fake review was posted;
• that your payment method was used;
• that the return address identifies the actor;
• that the parcel contents are harmless;
• that you may legally keep or discard the item everywhere.

Use evidence-calibrated language:

Do not use item value as the deciding fact. A cheap item can be a fulfillment error, sample, or brushing artifact. An expensive item can be a wrong shipment, unauthorized order, address-abuse event, or something else. Evidence controls the label.

Treat QR codes, callbacks, one-time codes, and apps as a separate risk

A physical parcel can be real while an insert inside it is hostile. A QR code may promise to identify a gift sender, activate a warranty, print a return label, cancel the delivery, or claim a reward. It can instead lead to a phishing site or malicious download. The FTC and USPIS describe this unexpected-package variation.

Do not scan the code or use the printed link, phone number, email, messaging account, or app. If a legitimate merchant relationship exists, navigate to the official app or site independently and locate the order there.

If you already interacted, classify the exposure by what happened:

The recovery action depends on the exposure. Do not say that every QR scan installed malware, and do not ignore credential or payment entry merely because the parcel itself looked ordinary.

If the main event is a text, email, phone call, fee notice, or link and no physical parcel arrived, use the fake delivery message guide. A real parcel does not make a later message trustworthy.

Keep Cash on Delivery and fee demands in their own branch

Cash on Delivery is a legitimate service in some countries and postal systems; for example, PHLPost publishes a current COD service. The risk is an unrecognized demand that cannot be matched to a real household or business order through an official account.

Before paying:

1. ask household or business members through a trusted channel;
2. open the merchant or marketplace's official app or site independently;
3. match the item, order, amount, recipient, and approved payment method;
4. verify any customs, postal, duty, or carrier fee only through the responsible authority's official channel;
5. do not provide a one-time or cancellation code to an unsolicited caller or worker unless you independently initiated and verified the exact official process.

The correct name, address, phone number, uniform, parcel, or real tracking event does not replace transaction verification. Social pressure at the door is not proof of a debt.

If the order cannot be verified, do not pay merely to avoid inconvenience. Follow the carrier's official refusal or support process where available; do not improvise a return to a printed address. If someone already paid, preserve the receipt, payment method, time, parcel, and delivery details. Contact the provider that handled the payment and the verified merchant or carrier. Cash, card, bank transfer, and wallet payments have different recovery options.

An unexpected customs, postage, redelivery, return, cancellation, storage, or activation fee may belong to the same payment-risk branch. Verify the underlying shipment first and then the authority that supposedly imposed the fee.

Preserve a private evidence packet

Evidence is useful only if it is safe, accurate, and sent to the actor that can use it.

When safe, preserve privately:

• photographs of all visible sides before altering the packaging;
• the exact addressee and address;
• the tracking number and result from the official carrier domain;
• the return address, shipper or merchant name, postmark, and reference numbers;
• the invoice, insert, and QR code without using them;
• a neutral description of the contents if the parcel was already opened safely;
• delivery date, time, location, and who received it;
• household confirmations and any legitimate match checked;
• screenshots of unknown orders, reviews, logins, account changes, and charges;
• COD or payment receipt;
• marketplace, carrier, regulator, bank, postal, or police case numbers.

Do not publish the full label, tracking or order number, barcode, QR code, address, phone number, email, account ID, customer number, signature, face, license plate, access code, invoice, payment data, security notification, or another person's details. Public redaction can fail because barcodes, QR codes, reflections, file metadata, and partial identifiers may remain readable.

Share the minimum necessary facts through the official platform, carrier, bank, regulator, postal, police, or biosecurity channel. Do not contact an unknown printed sender, reverse-search private people, accuse a warehouse or driver, or ask social media to identify someone from the label.

Use neutral statements such as:

A parcel bearing my name and address arrived on [date]. I cannot match it to a household order, gift, replacement, subscription, or payment. The carrier record shows [observable event]. My account review found [specific activity or no activity]. I have not used the enclosed code or payment route. Please confirm what your official process can verify and provide a case number.

If stronger evidence appears later, update the report. Do not make the first report stronger than the facts.

Send each issue to the actor that owns it

If you are unsure which commercial actor owns a non-emergency next step, use Who Should I Contact About a Package?. Keep separate deadlines separate: a carrier, platform, police, regulator, or postal report does not automatically pause a bank, account-recovery, seller, marketplace, or return deadline.

Reporting routes depend on what happened and where

Use these as scoped examples, not a global list of identical remedies.

United States

• Report suspected brushing or deceptive conduct to the relevant marketplace and, where appropriate, ReportFraud.gov.
• Use the U.S. Postal Inspection Service for mail-related crime within its remit and its suspicious-mail route for unsafe mail.
• Use IdentityTheft.gov when independent evidence indicates identity misuse; the parcel alone does not establish identity theft.
• Contact the bank or payment provider separately for an unknown transaction.

United Kingdom

• Report a verified retailer or account issue through the official business or platform route.
• Report Fraud is the national fraud and cybercrime reporting service for England, Wales, and Northern Ireland from December 2025. Scotland uses Police Scotland; emergencies use the emergency service.
• Royal Mail's wrong-recipient or suspicious-mail procedures are different from a fraud report.

Canada

• Use Canada Post for wrong-address or postal handling.
• Use the Canadian Anti-Fraud Centre for fraud or cybercrime reporting and local police when its current guidance calls for it.
• The Competition Bureau accepts information about deceptive marketing practices but does not replace the bank, marketplace, merchant, or postal process.

Australia

• Use Scamwatch for scam information and reporting, the ACCC for the current unsolicited-products framework, and the Department of Agriculture for biosecurity-risk items.
• Contact the relevant account and payment providers separately after unauthorized activity or loss.

European Union

• Use the marketplace or merchant's independently verified channel for the transaction and account record.
• Use the relevant national consumer authority or ECC-Net for cross-border consumer guidance where applicable.
• Postal, police, cybercrime, and payment routes remain national and fact-specific.

A report records what you submit and can support enforcement intelligence. It does not guarantee that a platform will identify the purchaser, remove a review, suspend a seller, stop future parcels, refund money, or tell you the investigation result.

Do not apply one country's “keep it” rule globally

The legal and operational treatment of unsolicited goods depends on the jurisdiction, whether a consumer relationship exists, and whether the goods were actually intended for the recipient.

• In the United States consumer situation described by the FTC, a company cannot demand payment for unordered merchandise sent to the recipient, and the recipient may treat it as a gift.
• In the European Union consumer context, ECC-Net says consumers are not obliged to pay for or return unsolicited goods.
• In Australia, the ACCC describes collection periods for unrequested products—one month after written notice or three months without notice—and expressly distinguishes goods not intended for the person.

These examples are not interchangeable. They do not authorize opening, keeping, discarding, donating, or forwarding another person's parcel; override postal rules; answer hazardous-item questions; or provide personal legal advice. Check the current consumer and postal guidance where you live before deciding what to do with an unresolved item.

Common situations that change the answer

“There is no order and no charge”

That rules out some explanations but does not prove brushing or eliminate all risk. A fake sales or review record may not create a visible charge. Preserve the parcel, check relevant account and review activity, report to an identifiable platform if appropriate, and monitor. Do not file a payment dispute without a transaction.

“It is only an empty envelope or a tiny item”

That can be consistent with brushing because a low-cost shipment can create a transport record. It can also result from a fulfillment error, split shipment, sample, or damaged package. The item type alone does not establish intent, account compromise, or safety.

“The box has marketplace branding, but support cannot find an order”

Packaging does not prove that your own marketplace account placed the order. Use the marketplace's official unsolicited-package report if it has one, preserve the case number, and check for unknown reviews or account events. Do not expect support to disclose another customer's or purchaser's information.

“More packages keep arriving”

Repetition increases the value of a platform, postal, or regulator report and careful address/account monitoring. Keep a dated log and case numbers. Repetition still does not identify the actor or prove which account or data source was used.

“Someone wants to pick the parcel up”

Do not arrange a private handoff through an unverified number, confront the person, follow them, or investigate them yourself. Contact the verified carrier, merchant, marketplace, property operator, or local police according to the facts, especially if the item is valuable or there are threats. Preserve messages and recordings privately where lawful.

“I opened it before realizing it was unexpected”

Opening an ordinary-looking parcel does not by itself prove or create account compromise. Stop using or consuming unknown contents, preserve the packaging and facts, and follow the relevant product, safety, platform, or account branch. If the item is hazardous or causes symptoms, leave the ordinary workflow and use local official guidance.

“The parcel was followed by a refund, return, or delivery message”

Evaluate the new contact independently. A real parcel does not authenticate a later link, caller, QR code, return label, or payment instruction. Navigate to the merchant, carrier, or platform from a trusted bookmark or independently found official site.

Know when the investigation can stop

You do not need to keep escalating after a benign explanation is independently confirmed.

The scam and security inquiry can stop when:

• a trusted household member or gift sender confirms the parcel;
• an official order, replacement, subscription, promotion, or return record matches it;
• the carrier and merchant context are consistent;
• relevant account and payment checks show no unauthorized activity;
• no QR, callback, COD, fee, safety, or wrong-recipient concern remains.

Document the match if useful. Any remaining issue—wrong item, damage, return, warranty, or product safety—belongs to its ordinary merchant or carrier workflow.

If no explanation appears, “unexplained unordered parcel” is an accurate final classification. Preserve the private record, report proportionately, monitor for new account or payment evidence, and avoid turning uncertainty into an accusation. A calm, evidence-based report is more useful than a confident label the facts do not support.