Got a parcel you didn’t order? It could be a scam – here’s what to do

Finding a surprise parcel on your doorstep might feel like a win at first, but if you didn’t order it, there’s a good chance it’s not a freebie. 

Scammers are using a trick known as a “brushing” scam, and it’s becoming more common across the UK. It might seem harmless, but it can be a sign your personal details have been exposed. 

Here’s what’s really going on and what you should do next. 

What is a brushing scam?

A brushing scam is when a seller sends out parcels to random people who didn’t order anything. 

They do this so they can leave fake “verified” reviews under your name. This helps boost their ratings online and makes their products look more trustworthy than they actually are. 

You don’t get charged for the item, but your name and address have been used without your permission. 

Why have I been sent something I didn’t order? 

If a parcel shows up out of the blue, it usually means your details have ended up on a list somewhere. 

This could happen if: 

• Your data was part of a leak or breach  

• Your details were sold on by a third party  

• Your information is publicly available online  

Even if it seems minor, it’s a sign your personal data is being shared more widely than you might think. 

Is a brushing scam dangerous? 

On its own, the parcel might not seem like a big deal, but it can point to a bigger issue. 

If scammers have your name and address, they could try to use that information in other ways. That might include more targeted scams, phishing attempts, or even trying to access your accounts. 

What should I do if I receive a parcel I didn’t order? 

If this happens to you, don’t panic. There are a few steps you can take: 

1. Don’t pay for it 

You’re under no obligation to pay for anything you didn’t order. 

2. Don’t interact with anything inside 

Avoid scanning QR codes or calling any phone numbers included in the package. These could lead to phishing scams. 

3. Report it to the retailer 

If you can see where the parcel came from (Amazon, Temu, Shein), contact the retailer or platform to let them know. 

4. Keep an eye on your accounts 

Check your bank statements and online accounts for anything unusual over the next few weeks. 

5. Change your passwords if needed 

If you’re worried your data has been exposed, updating your passwords is a smart move. 

Can I keep the item? 

In most cases, yes. If something is sent to you that you didn’t order, you’re not legally required to return it or pay for it. 

That said, it’s still worth reporting it so the retailer is aware of what’s going on. 

How can I protect my personal information? 

This kind of scam is a good reminder to tighten up your data security. 

A few simple habits can make a big difference: 

• Use strong, unique passwords for different accounts  

• Be careful where you share your personal details  

• Avoid clicking on suspicious links or messages  

• Check if your email has been involved in a data breach  

The less your information is floating around online, the harder it is for scammers to use it. 

If something doesn’t feel right...

If you do think something’s off, you can get in touch with your bank and cut off any contact with the sender.  

You can also report it to Action Fraud, which helps track scams across the UK, and forward suspicious emails to report@phishing.gov.uk. 

It’s also worth checking your statements over the next little while and updating any passwords you’re unsure about, just to keep everything secure. 

A few small steps like these can help you stay in control and keep things running as they should. 

For more guidance on staying safe and spotting scams, check out our fraud and scams hub. Taking these steps can help you stay in control without stressing over every unexpected parcel.