MalwareZero

Unordered Temu and Shein packages, and what they say about your data

Updated August 6, 2026

Most people read an unordered Temu or Shein parcel as proof their account got broken into. It's closer to the opposite. A compromised account spends your money and leaves a charge behind; brushing spends the seller's money and leaves no charge at all, because the entire point is shipping a cheap item to a real address so a fake account can leave a glowing review carrying a verified-purchase badge. That's the line between the two, and a card statement settles which one you've got. You can keep it, you owe nothing, and nobody needs your card details to make it stop. The reporting route differs on each platform, and the more useful question is how your address got onto a seller's list in the first place.

Both platforms produce a lot of these boxes for structural reasons. Each runs an enormous pool of independent sellers competing inside the same search results, where ranking depends heavily on sales volume and review count. Faking sales is cheap. A ring or a keychain costs the seller well under a dollar including postage, and one verified review can move a listing up a page.

How the marketplace version differs from Amazon

On Amazon, the brushing package usually arrives in Amazon packaging with a tracking number you can look up, and there's a dedicated reporting form. Temu and Shein shipments often arrive in a plain polybag with a printed label, sometimes with no packing slip at all, and often with a return address at a US fulfillment center in California that has nothing to do with the actual seller.

You'll also see multiples. A common report isn't one package but a run of them over weeks, sometimes from different senders, because once an address is known to work it gets resold.

Reporting an unordered package to Temu

Temu handles this through support rather than a public form. In the app, open the You tab, go to Support, and start Live Chat or submit a ticket. Say plainly that you received a package you didn't order, give the tracking number from the label, and ask them to identify and investigate the seller. Temu's stated position is that it "strictly prohibits this practice and will take action against violators," which is the line to hold them to.

Email works too, at help@temu.com, and there's a phone line at 1-888-495-8368 running roughly 7 AM to 11 PM Eastern. Reply quality varies by agent. If the first response is a canned refund offer for an order you don't have, reopen the ticket and ask specifically for a seller investigation.

Never use contact details printed on the package or on an insert card. That's the one rule here with no exceptions.

Reporting an unordered package to Shein

Shein routes this through customer service as well. On the website, go to us.shein.com and use the Contact Us link, then the customer service button, which opens a chat or lets you file a ticket. In the app the path is Me, then Support, then Customer Service, and you type the problem into the message box.

I couldn't find a dedicated brushing report form for Shein comparable to Amazon's, and I'm not going to invent one. Describe it as an unsolicited shipment, include the parcel number, and ask whether an order exists under your name or email address. That last question is the important one, and it's the part most people forget to ask.

Check whether an account exists in your name

Two versions exist and they call for different responses. Either a seller bought a list of addresses and shipped to yours, in which case nothing of yours was accessed, or someone registered an account using your email and the delivery is a byproduct.

So where did they get your address?

Honestly, from a market you were never part of. Two sources dominate.

One is old breaches. Shein's former parent company Zoetop was fined $1.9 million by the New York Attorney General in October 2022 over a June 2018 breach that exposed roughly 39 million SHEIN accounts and 7 million ROMWE accounts, and the state found the company failed to notify most affected users or reset their passwords. That data didn't evaporate. Breach dumps circulate for a decade or longer, merged with newer ones into better lists.

The other source is data brokers, and it's the bigger channel by far. A February 2026 report from the Senate Joint Economic Committee's minority staff estimated that identity theft tied to just four broker-linked breaches (Equifax in 2017, Exactis in 2018, National Public Data in 2023, and TransUnion in 2025) cost Americans about $20.9 billion. The same report found brokers using no-index tags so their own opt-out pages wouldn't appear in search results, which tells you how seriously that process was meant to be taken.

What you can actually do about the leak

Removing yourself from brokers one at a time is a grind, and records reappear as fresh sources get scraped. There is one genuinely new lever, and its timing happens to be relevant this month.

California's Delete Act created a single deletion request platform called DROP, run by the California Privacy Protection Agency. Consumers have been able to submit requests since January 1, 2026, and as of August 1, 2026 registered data brokers must check the platform at least once every 45 days and process what they find, with a $200 per day penalty for each request they ignore. It covers California residents only. Roughly half of states have some privacy law now, but a one-click, all-brokers deletion right is still unusual, and I can't tell you whether anything similar covers you without knowing your state.

Everywhere else, the practical moves haven't changed. Freeze your credit at all three bureaus, which is free. Pull your reports at annualcreditreport.com. Use a unique password and two-factor authentication on any shopping account holding a saved card.

The insert card is the part that can cost you money

A cheap keychain can't hurt you. A QR code can. The current pattern is a small printed card promising to reveal the sender, register a warranty, or hand over a free gift, and the FBI warned about exactly this in alert I-073125-PSA on July 31, 2025, describing codes that lead to credential phishing or malware installs.

To see where a code points without letting your phone touch it, you can decode a photo of it in your browser and read the destination first. The wording used on these cards is worth recognizing, since it's the same handful of scripts repeated endlessly. If you already scanned, work through the recovery steps in order rather than panicking about every account at once.

Keep it, return it, or throw it away

Federal law under 39 U.S.C. 3009 lets you treat unordered merchandise as a gift, and both the FTC and the US Postal Inspection Service say the same thing: no obligation to pay, no obligation to return. Unopened with a return address on it, you can mark it RETURN TO SENDER and hand it to USPS. Opened, it's yours.

I'd make one exception, for anything you'd put in or on your body. Supplements, skincare, and food from an unknown seller aren't worth the gamble, and neither are unbranded batteries or chargers.

What I wouldn't bother with

Don't chase the seller yourself. Skip the police report unless money actually moved or a threat followed. Don't buy a data removal subscription in the first week of alarm, since the same money spent on a credit freeze and a password manager does more. If packages keep coming, report it at reportfraud.ftc.gov, and for anything involving a scanned code, ic3.gov is the right destination.

The Amazon version has its own quirks, including a form Amazon genuinely reads, and it's covered in the Amazon-specific walkthrough. For the general mechanics of why sellers do this at all, see how brushing works across platforms.

A mystery parcel feels like being watched, and it isn't that. It's a data record being resold by an industry with no reason to stop until deletion rules get teeth. The version that does reach you is the card tucked in beside the item, so if one of those already got you as far as scanning and typing something in, open the recovery steps next and work them in the order they're written, because the sequence matters more than the speed.