The Singapore Shopper’s Guide to Brushing Scams, Unordered Parcels, “Scan to Claim” Follow-Ups and What the Law Says About Unsolicited Goods
Description: Why a parcel you never ordered can turn up at your door in Singapore: brushing scams and fake verified-purchase reviews, wrong addresses, gifts and seller errors, plus QR-code and pay-to-receive follow-ups, what it says about your personal data, what to do, and whether you must return or pay.
Primary Keyword: brushing scam
Secondary Keywords: unordered parcels, parcel I didn’t order, unsolicited goods Singapore, brushing scam Singapore, fake verified reviews, QR code parcel scam, scan to claim scam, cash on delivery scam, ScamShield 1799, personal data leak
Website: wahliao.com
Article Type: Series Guide
Parent Article: How Shopping Works | Shopping Scams in Singapore
Last checked: 25 October 2026
Quick Answer
A brushing scam is when a seller sends cheap items to real addresses so it can record fake orders and post “verified purchase” reviews of its own products.
The parcel at your door is a prop.
The real target is the review system.
Not every unordered parcel is a brushing scam, though.
It might be a wrong address.
It might be a gift.
It might be a seller sending the wrong item.
It might be someone using your account.
It might be the opening move of a scam that asks you to scan a QR code or pay.
The parcel itself is usually harmless.
What comes after it is where the risk sits.
The smart shopper does not only ask:
“Who sent me this?”
The smart shopper asks:
“What does this parcel tell me about my data and my accounts, and is anyone now asking me to scan, click or pay?”
1. What a Brushing Scam Actually Is
The word “brushing” comes from the idea of brushing up a seller’s numbers.
More orders.
More sales.
More reviews.
On a marketplace, those numbers help decide where a product shows up in search and how trustworthy it looks to the next buyer.
A brushing scam fakes those numbers using real addresses.
The seller creates an order.
The order needs a delivery address that looks genuine.
So the seller uses yours.
A cheap item, or sometimes an empty envelope, is shipped to you.
The courier records a successful delivery.
Now the platform sees a completed order to a real address.
The seller, or someone working with it, posts a glowing review under the account that placed the order.
Examples:
a phone case you never chose
a packet of hair ties or a sticker sheet
a plastic toy with no note
an envelope with nothing inside
an item that does not match the label on the box
In a brushing scam, you are not the customer. You are the address that makes a fake order look real.
2. Why “Verified Purchase” Is Worth Faking
Shoppers trust reviews more when the platform shows the reviewer actually bought the item.
That is the point of a verified-purchase badge.
Brushing attacks that exact gate.
If the order was placed and the parcel was delivered, the review can look verified.
Something was bought.
Something was delivered.
It just was not bought by a real customer for real use.
That is why brushing can be worth the postage to a dishonest seller.
A product with many verified five-star reviews can rise in search and sell more.
The cheap parcel to your flat is, to them, a marketing expense.
Uneven reviews, oddly similar wording and sudden jumps in review counts are reasons to read more carefully, which we cover in our guide to reading product reviews.
3. Not Every Unordered Parcel Is a Scam
Before you assume the worst, run through the ordinary explanations.
Examples:
the address belongs to a previous tenant or owner
a neighbour’s unit number was keyed in wrongly
a family member used your address for their own order
a friend sent a surprise gift
a seller packed the wrong item or sent a duplicate
a free sample from a shop you once bought from
a replacement for an earlier faulty order
In an HDB block, a single digit can send a parcel two floors away.
In a condo, the guardhouse may receive parcels for several units with similar numbers.
At home, a parent or sibling may have ordered something under the family address without mentioning it.
Shopee’s own help page for unordered parcels suggests the same first steps: check your purchase history, then ask family and friends whether someone sent it or ordered it for you.
Ask:
Is my name on the label, or someone else’s?
Is the unit number exactly mine?
Did anyone at home order something recently?
Is there a gift note or sender name I recognise?
Check the label before you check your fears.
4. The Dangerous Part: QR Codes and “Scan to Claim”
A plain brushing parcel usually asks nothing of you.
That is a useful test.
If an unordered parcel comes with an instruction, slow down.
Some unexpected deliveries carry a printed card with a QR code.
The note may say you have won something.
It may say a gift is waiting.
It may say you need to confirm delivery.
It may say you must scan to see who sent it.
A QR code is just a link you cannot read with your eyes.
In a joint advisory issued on 22 May 2023, SPF and the Cyber Security Agency of Singapore (CSA) warned that malicious QR codes can lead to phishing sites that harvest login and card details, or to downloads that install malware.
The same advisory warned against scanning codes from unknown senders.
An unordered parcel with a QR card is exactly that.
Ask:
Why would a real gift need me to log in somewhere?
Why would a delivery I never requested need my card?
Does the link open the official website, or a look-alike address?
An unordered parcel is a curiosity. An unordered parcel that asks you to scan, log in or pay is a warning.
5. Pay-to-Receive and Cash-on-Delivery Demands
Another follow-up is a request for money.
A message or a person at the door says a parcel is waiting, but you need to pay first.
It may be called a delivery fee, a customs fee, a redelivery charge or a cash-on-delivery amount.
If you did not order anything, there should be nothing to pay.
SPF’s December 2023 advisory on parcel delivery phishing scams said delivery fees are normally paid when you buy, and that SingPost does not ask for extra payment through embedded links.
It said SingPost payments should go only through the SingPost Mobile App, SAM machines or a post office.
The police recorded at least 362 victims of these parcel phishing scams from January to November 2023, with losses of at least S$560,000.
Ask:
Do I have a matching order in any of my accounts?
Is the request coming through a link, or through the official app I already use?
If someone at the door asks you to pay for an item you did not order, you can simply decline.
Do not pay just to make an awkward moment end.
Our guide to fake parcel and delivery messages covers the message side in more detail.
6. What an Unordered Parcel Says About Your Personal Data
Even a harmless brushing parcel carries one uncomfortable message.
Someone had your name and address.
They may also have had your phone number, since many parcels need one for delivery.
That information came from somewhere.
Usually, you cannot know where.
Even the platform that carried the order may not be able to tell you how the seller got your details.
Possible routes include:
an old leaked database from any service you once signed up for
details you entered on a lucky draw, survey or free-gift form
a previous online order where the data later leaked
public information, such as a business listing with your address
someone who already knew you
Name and address are only the first layer, but combined with your phone number, email or logins, they make phishing messages more convincing.
A scam message that greets you by full name and mentions your street feels more trustworthy.
That is exactly why it is useful to scammers.
Treat an unordered parcel as a small alarm bell about your data, not as proof that your bank account is in danger.
For the rules on how businesses may collect and use your personal data, see our guide to shopping accounts and the PDPA.
7. Could Someone Be Using Your Account?
Sometimes the parcel came from a real order on a real account.
Yours.
If someone has your shopping login, they may place orders, change saved addresses or use stored cards.
This is the more serious version.
Shopee’s help page says that if an unknown order shows up in your purchase history, your account may be compromised, and you should change your password immediately and contact customer service.
The same logic applies to any marketplace you use.
Check:
your order history on each platform you use
your saved delivery addresses
your saved cards and wallets
your email inbox for order confirmations you did not expect
your bank and card statements for charges you do not recognise
If you find an order you did not place, act quickly.
Change the password.
Turn on two-factor authentication if the platform offers it.
Remove saved cards you do not need.
Contact the platform through its official app or website.
Call your bank if a card was charged.
If the order is in your account, it is not a brushing parcel. It is an account problem, and it needs fixing today.
8. The Singapore Layer: What the Law Says About Unsolicited Goods
This is the question many people really want answered.
Do I have to pay for this?
Singapore’s main consumer protection law, the Consumer Protection (Fair Trading) Act (CPFTA), has a schedule listing unfair practices.
That list includes a supplier asserting a right to payment for unsolicited goods or services.
It also includes sending a consumer an invoice or similar document seeking payment for them.
There is also a specific set of rules under the CPFTA: the Consumer Protection (Fair Trading) (Opt-Out Practices) Regulations 2009, in force since 15 April 2009.
In the version we checked, these regulations define unsolicited goods as goods supplied in a consumer transaction to a consumer who did not ask for them.
They say that, until the consumer expressly agrees in writing to accept and pay, the consumer may treat the goods as an unconditional gift from the supplier.
They also say consent cannot be assumed from silence, from time passing, or from using or throwing away the goods.
If you did pay for unsolicited goods, the regulations let you ask for a refund in writing within 12 months of paying, and the supplier must refund within 60 days.
Two important limits.
First, these rules are written around consumer transactions with a supplier.
A brushing parcel is an odd fit, because the sender is not really trying to sell to you.
In practice, nobody usually asks a brushing recipient to pay at all.
Second, the definition excludes goods sent to someone who knew, or should have known, that they were meant for someone else.
That is the wrong-address case, covered below.
This is general information, not legal advice.
If someone is actually demanding payment for goods you never ordered, check the current text on Singapore Statutes Online, or ask the Consumers Association of Singapore (CASE) for guidance on your situation.
In Singapore, a business cannot simply post you something you did not ask for and then insist that you pay for it.
9. Do You Have to Return It, Pay for It, or Keep It?
Here is the practical version.
If it is a brushing parcel, there is usually nothing to return and nobody to pay.
Shopee’s help page says that, unless a relevant party advises otherwise, you can dispose of an unordered parcel and do not need to send it back to Shopee or the seller.
Other platforms may have their own guidance, so check their help centre if the parcel came through them.
If it is a seller error, contact the seller or platform through official channels.
They may arrange a collection, or tell you to keep it.
If it is a wrong address, it is not yours to keep.
If anyone asks for money for something you did not order, do not pay.
Examples:
a random phone case from an unknown seller: likely brushing, so check your accounts and move on
a bottle of shampoo addressed to the previous tenant: wrong address, so return it
a duplicate of something you did order: seller error, so tell the seller
a box with an invoice demanding payment: do not pay, and ask CASE if pressed
10. Wrong-Address Parcels Are Different
A parcel addressed to someone else is not a free gift.
The Opt-Out Practices Regulations themselves exclude goods sent to a person who knew, or should have known, they were meant for another person.
Common sense says the same.
If the label shows a different name, a different unit or a previous occupant, the item belongs to someone who is probably waiting for it.
Simple options:
pass it to the right neighbour if the unit number is just slightly off
contact the courier using the details on the label or its official website
leave it with the condo guardhouse with a note
for post, follow the postal operator’s official return-to-sender process
Do not open someone else’s parcel to find out what is inside.
If the name on the label is not yours or anyone’s in your household, treat the parcel as lost property, not a windfall.
If you are the one waiting for a parcel that went missing, our guide to parcels marked delivered but not received walks through what to do.
11. Reporting: Platform, ScamShield and Police
Who you tell depends on what happened.
If it is a plain brushing parcel and nothing else, report it to the platform named on the label, through its official app or website.
If the parcel came with a QR code, a link or a payment request, do not scan or click.
You can call the ScamShield Helpline at 1799, which ScamShield says runs 24 hours a day, to check whether something is a scam and get advice.
You can also report scam messages through the ScamShield app.
If you have lost money or given away bank details, call your bank immediately.
ScamShield says the 1799 helpline can connect scam victims to several major banks.
Then file a police report through the SPF e-services portal.
ScamShield notes that the helpline itself cannot file police reports for you.
For urgent police help, call 999.
If the parcel contains something that looks illegal, Shopee’s help page says to report it to the police as soon as possible.
12. Strong Signs and Weak Signs
Strong signs it is a harmless brushing parcel:
your name and address are correct, but no sender you recognise
a cheap, random item with no note
no message, call or QR code follows
no matching order appears in any of your accounts
no unusual charges on your cards
Signs it may be an innocent mix-up:
the name is a previous tenant’s or a neighbour’s
the unit number is one digit off
a family member recognises it
it duplicates something you did order
Weak signs, where you should treat it as a possible scam:
a card or note with a QR code and an instruction to scan
a message asking for a fee to release or redeliver the parcel
a caller who mentions the parcel and then asks for personal details
a page that asks for your bank login, card number or OTP
pressure to act fast or lose a “prize”
an order you did not place inside your own account
A silent parcel is mostly a data warning. A parcel that talks to you is a scam warning.
13. Practical Method: The Doorstep Routine
Use this whenever something arrives that you did not expect.
It takes about ten minutes.
1. Read the label first
Check the name, the unit number and the sender.
If it is clearly for someone else, stop here and return it to the right person or courier.
2. Ask the household
Message family members and anyone who uses your address.
Gifts and forgotten orders explain a surprising number of mystery boxes.
3. Check every shopping account
Open each platform you use and check order history, saved addresses and saved cards.
If there is an order you did not place, change the password, turn on two-factor authentication and contact the platform.
4. Do not scan, click or pay
Ignore any QR code, link or payment request that came with the parcel or afterwards.
If you want to check something, go to the official app or website yourself.
5. Tighten your data
Change passwords you have reused across sites.
Be more careful with lucky draws and free-gift forms that ask for your address and phone number.
6. Report in the right place
Tell the platform if its name is on the label.
Call ScamShield at 1799 if you are unsure whether something is a scam.
Call your bank and file a police e-report if money or bank details were involved.
7. Decide what to do with the item
For a brushing parcel, you can usually keep it or throw it away.
For a seller error, follow the seller’s instructions.
For anything that looks unsafe or illegal, leave it alone and report it.
14. Unknown Contents and Safety
Most brushing parcels contain something cheap and ordinary.
Occasionally, the contents are unclear.
A loose powder.
Seeds.
A liquid with no label.
Something that looks like medication.
Do not use, eat, plant or pass on anything you cannot identify.
You have no idea where it came from or what it is.
Keep it away from children and pets, and seek official advice before handling it further.
Free is not a reason to trust something you cannot identify.
15. Helping Parents and Older Relatives
Older relatives may feel they must do something about a mystery parcel, such as calling the number on the card or scanning the code to find out who to thank.
A short conversation helps.
Things worth saying:
you never have to pay for something you did not order
a QR code on an unexpected parcel is not a thank-you card
a real courier will not ask for bank details to deliver a box
if unsure, call 1799 or call me before doing anything
Scam numbers in Singapore are still large.
SPF’s Annual Scam and Cybercrime Brief 2025 reported total scam losses of S$913.1 million in 2025.
E-commerce scams fell 42.5% to 6,703 cases, yet still had the most cases of any scam type.
Phishing scams had the second-highest number of cases, and the brief noted scammers impersonating delivery providers to send fake payment links.
A mystery parcel is a good, low-stakes moment to have the talk.
Final Summary
A brushing scam uses your real address to make fake orders look genuine, so a seller can post verified-looking reviews.
The parcel itself is usually cheap and harmless.
It still tells you that someone has your name and address, and possibly more.
Not every unordered parcel is brushing.
Wrong addresses, gifts, seller errors and family orders are common.
An order inside your own account is an account problem that needs fixing at once.
The real danger is the follow-up.
A QR code to scan.
A link to click.
A fee to pay.
Do none of those.
In Singapore, the CPFTA treats demanding payment for unsolicited goods as an unfair practice, and the Opt-Out Practices Regulations let consumers treat genuinely unsolicited goods from a supplier as a gift.
A parcel meant for someone else is different, and should go back.
When money or data is involved, call your bank, check with ScamShield at 1799 and make a police e-report.
So the smartest question is not:
“Who sent me this?”
It is:
“Is anyone now asking me to scan, click or pay, and are my own accounts still mine?”
Simple Checklist
When an unordered parcel arrives, ask:
- Is the name and unit number on the label really mine?
- Has anyone in my household ordered it or sent it as a gift?
- Is there an unknown order in any of my shopping accounts?
- Are my saved addresses and saved cards still as I left them?
- Is there a QR code, link or note asking me to do something?
- Is anyone asking me to pay a fee for this parcel?
- Have I changed reused passwords and turned on two-factor authentication?
- Have I reported it to the platform named on the label?
- If I lost money or bank details, have I called my bank and filed a police report?
- Is the item safe and identifiable, or should I leave it alone and report it?
If the answer is unclear, pause.
Do not scan, do not pay, and check through official channels first.
Where the Facts Come From
Consumer Protection (Fair Trading) (Opt-Out Practices) Regulations 2009 (S 67/2009)
Singapore Statutes Online – Opt-Out Practices Regulations (check the current version)
Consumer Protection (Fair Trading) Act, Second Schedule (unfair practices), copy published by CASE
CCS – Overview of the Consumer Protection (Fair Trading) Act
Shopee Help Centre – What to do if you receive a parcel you didn’t order
SPF and CSA – Joint advisory on protecting yourself from malicious QR codes (22 May 2023)
SPF – Police advisory on parcel delivery phishing scams (15 December 2023)
SPF – Annual Scam and Cybercrime Brief 2025
ScamShield – 1799 Helpline
SPF e-services – Lodge a police report
Consumers Association of Singapore (CASE)
We did not find an SPF, MHA or CSA advisory specifically about brushing in Singapore when we checked in October 2026. The description of brushing here is a general explanation of how the practice works, alongside Shopee’s own guidance on unordered parcels.
Prices, rules and platform features change. We last checked this page on 25 October 2026. General information, not financial, legal or medical advice.
Continue Reading
How Shopping Works | Shopping Scams in Singapore
How Shopping Works | The Big Picture
Parcel Marked Delivered but Not Received: What to Do, Step by Step
Shopping Accounts and Your Personal Data: PDPA, Marketing Consent and the Do Not Call Registry
How Shopping Works | How to Read Product Reviews
Fake Parcel and Delivery Messages: How the Scam Works and What Couriers Really Send
Fake Online Shops: How to Check a Shopping Website Before You Pay
Social Media Shop Ads That Never Deliver: How They Work and How to Check
Chargebacks and Card Disputes: Getting Money Back After a Bad Online Purchase
brushing scam, brushing scam Singapore, unordered parcels, parcel I didn’t order, unsolicited parcel, unsolicited goods Singapore, received package I didn’t order, fake verified purchase reviews, fake reviews marketplace, mystery parcel Singapore, wrong address parcel, seller sent wrong item, QR code parcel scam, scan to claim scam, malicious QR code, pay to receive parcel scam, cash on delivery scam, delivery fee scam SMS, parcel phishing Singapore, SingPost payment scam, personal data leak, shopping account hacked, unknown order in my account, change password two-factor authentication, ScamShield 1799, ScamShield helpline, police e-report scam, report scam Singapore, CPFTA unsolicited goods, Opt-Out Practices Regulations, do I have to pay for unsolicited goods, do I need to return unordered parcel, CASE consumer advice, Shopee unordered parcel, online shopping safety Singapore, how shopping works, Singapore shopper guide, wahliao shopping guide
