A plain white envelope shows up in your mailbox. It is addressed to you. It may even have a tracking number. The sender’s name looks unfamiliar, but the delivery seems real. Then you open it. Nothing is inside. No note. No product. No explanation.
That would make anyone curious. And that is exactly what scammers may be counting on. Investigators and consumer protection groups have warned that empty envelopes and mystery packages can be tied to a scam known as brushing. In a more dangerous version, the package may include a QR code that tries to send you to a fake website or steal your personal information.
The bigger risk is what scammers hope you do next. If they can get you to scan a QR code, click a link, call a fake number or enter personal information, that strange envelope can turn into a much bigger problem.
Sign up for my FREE CyberGuy Report
QR CODE SCAMS RISE AS 73% OF AMERICANS SCAN WITHOUT CHECKING
The empty envelope scam is often connected to brushing. That is when a third-party seller sends a cheap item, or sometimes an empty envelope, to a real person’s address to make it look like a real order was delivered.
Once the package gets marked as delivered, a shady seller may use that delivery record to post a fake “verified buyer” review on an online marketplace. Those reviews can make junk products look more popular than they really are.
Recent reports describe people receiving small white padded envelopes from unfamiliar or possibly fake sender names. Some people get them more than once. Others receive cheap trinkets, packing material or nothing at all.
That may seem like a strange nuisance. But to me, the bigger concern is this: someone may already have your name and home address.
Scammers do not need to send you anything valuable. They only need a tracking number that shows something arrived at a real home. Here is how the scam often works:
A scammer gets your name and address from a data broker, public record, old breach or online leak. Then they create a fake order using your information. Next, they mail a cheap item or an empty envelope to your home.
After the delivery gets marked as complete, the seller can make it appear that you bought the product. A fake positive review may then appear under your name or account details. That helps bad sellers boost ratings and fool real shoppers. It also shows that your personal information may already be floating around, where scammers can grab it.
THE ONE THING SCAMMERS CHECK BEFORE TARGETING YOU ONLINE
Some mystery packages now include a QR code. The message may sound harmless. It may say something like “scan to see who sent this gift” or “scan to verify delivery.” Do not scan it.
A QR code is a hidden link. You cannot easily see where it leads before your phone reads it. Scammers know curiosity is powerful, especially when a package arrives with your name on it.
That QR code may send you to a fake website that asks for your name, phone number, address, credit card, bank login or shopping account password. It may also try to trick you into entering a one-time verification code.
That is where the real financial risk begins. If you give scammers your login details or banking information, they may be able to take over accounts, make purchases or access payment apps.
If an envelope or package arrives and you did not order it, do not panic. Treat it as a warning sign and take a few smart steps.
Even if the card says you need to scan it to identify the sender, skip it. Go directly to the retailer, shipper or official website yourself.
Scammers may include a fake customer service number or website inside the package. If you need to contact Amazon, Walmart, eBay, USPS, UPS or FedEx, type the official website into your browser or use the company’s official app.
Log in directly to your Amazon, Walmart, eBay, TikTok Shop and other shopping accounts. Look for orders you do not recognize, strange reviews, changed addresses or unfamiliar payment methods.
Start with your email, shopping accounts and financial accounts. Use strong, unique passwords and consider using a password manager to create and store them safely. Do not reuse the same password across multiple sites. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com
Two-factor authentication, also called 2FA, adds a second step to your login so a password alone isn’t enough. Use an authenticator app when possible. It gives you stronger protection than text messages and makes it harder for a scammer to get into your accounts.
Look for small test charges, unfamiliar purchases, new subscriptions or withdrawals you did not make. Report anything suspicious to your bank right away.
If you think your identity may be at risk, review your credit reports. You can also consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
Report suspicious packages to the U.S. Postal Inspection Service at uspis.gov/report. You can also file a scam report with the FBI’s Internet Crime Complaint Center at ic3.gov. If a retailer’s name appears on the label, report it directly through that retailer’s official site.
WARNING SIGNS YOUR MAIL HAS BEEN FRAUDULENTLY REDIRECTED
Scanning a QR code does not always mean your accounts are compromised. But if you entered information, downloaded an app or typed in a verification code, act quickly.
A good security tool can help block phishing websites, unsafe links and malicious downloads before they cause damage. We recommend using a strong antivirus software because it adds protection beyond basic virus scanning. It includes phishing protection, scam protection and web threat blocking for Windows, Mac, Android and iOS. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
Brushing scams often start because your name, home address, phone number or other details are already online. Data brokers collect and sell this information. Scammers can use it to make their tricks feel more believable. A data removal service can help reduce your exposure by requesting that your personal information be removed from broker sites. We recommend using a good data removal service to help remove your personal information from data broker sites and reduce the amount of data scammers can use to target you. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
An empty envelope may look harmless, but it can be a sign that your personal information is already being misused. The most important move is to avoid anything inside the package that tries to pull you into another step. Do not scan QR codes from mystery packages. Do not call unknown numbers printed on cards. Do not enter personal information on a website you reached from a package you never ordered. Scammers are counting on curiosity. Slow down, go directly to official websites and secure your accounts before a strange envelope turns into a much bigger headache.
Have you received an empty envelope or mystery package you never ordered? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
