eBay Brushing / Unsolicited Parcel Scam
You receive unexpected packages that appear to have been purchased through eBay. The real sender is a third-party seller manipulating the review system — and your personal data may have been compromised.
Part of: Brushing: Unsolicited Parcel Scams
Last reviewed: 8 June 2026
Brushing scams exploit marketplace infrastructure to generate fraudulent verified-purchase reviews. A dishonest seller orders cheap, lightweight goods — often seeds, cheap jewellery, or small electronics — using your name and address, ships the parcel to you, then posts a glowing five-star review from the account they opened in your name.
eBay's platform is impersonated in these schemes because eBay's strong brand recognition makes an unexpected parcel seem more legitimate. Victims often assume it is a surprise gift or a mistaken delivery and think little of it — precisely what the scammer wants.
The deeper concern is that the scammer obtained your name and postal address from somewhere — a data breach, a previous purchase leak, or a social media profile. They may also have created a shell eBay account in your identity, which you should locate and close.
How this scam works on the eBay brand
You receive a parcel with an eBay packing slip but no return address, or with a Chinese-language invoice that contains your correct name and address. Inside is a low-value item you never ordered.
Shortly after, a suspicious five-star eBay review may appear for a seller whose products you have never bought — posted from an account bearing a slight variation of your name. The review drives search ranking for the seller and helps them accumulate the credibility needed to list higher-value goods.
Some variants include a QR code inside the parcel leading to a fake eBay page asking you to 'claim a free gift' or 'register your delivery', harvesting further personal data or leading to a subscription trap.
Common red flags
- A parcel arrives addressed to you but you placed no eBay order; the return label shows an unfamiliar or overseas address
- The packing slip has an eBay logo but no valid order number you can verify in your eBay account
- A QR code inside the parcel asks you to log in or provide personal details to claim a prize
- You notice an eBay account was created using your email or a close variation of it
- A glowing review appears in eBay seller feedback for a seller you have never purchased from
- The parcel contents are trivial items like seeds, silicone rings, or small LED lights
How to protect yourself
- Log in to your genuine eBay account and check 'Purchase History' — if there is no record, the item was not legitimately ordered through your account
- Search eBay for accounts using your name or email address and report any you did not create to eBay's customer support
- Check HaveIBeenPwned.com to see whether your email address has appeared in known data breaches
- Do not scan any QR codes inside the parcel or visit URLs printed on it
- You are not obligated to return or pay for unsolicited items — in most jurisdictions they are legally yours to keep or discard
- Monitor your credit report for signs that your name and address are being used in fraudulent applications
How to report it
- Report the suspicious package and any fake eBay accounts to eBay's Trust & Safety team via the 'Report a problem' link on ebay.com
- File a report with the FTC at reportfraud.ftc.gov describing the brushing scheme
- If a fraudulent account was created in your name, report identity concerns to identitytheft.gov
- Notify your local postal carrier if you continue to receive unsolicited parcels
Frequently asked questions
Do I have to send the package back?
No. In the US and most other countries, unsolicited goods are considered a free gift — you have no obligation to pay for them or return them.
Why would someone send me something I did not order?
Unscrupulous sellers pay for brushing campaigns to inflate their review scores on marketplaces like eBay. Your address was obtained from a data breach or public records.
Is my eBay account at risk?
Your real eBay account may be fine, but check for any accounts created in your name. Change your password and enable two-step verification as a precaution.
How did they get my address?
Most brushing operations source addresses from data breaches, purchased marketing lists, or public records. Signing up for breach alert services like HaveIBeenPwned helps you stay informed.