Empty envelope scam explained and how to protect your personal data

A plain white envelope shows up in your mailbox. It is addressed to you. It may even have a tracking number. The sender’s name looks unfamiliar, but the delivery seems real. Then you open it. Nothing is inside. No note. No product. No explanation.

That would make anyone curious. And that is exactly what scammers may be counting on. Investigators and consumer protection groups have warned that empty envelopes and mystery packages can be tied to a scam known as brushing. In a more dangerous version, the package may include a QR code that tries to send you to a fake website or steal your personal information.

The bigger risk is what scammers hope you do next. If they can get you to scan a QR code, click a link, call a fake number or enter personal information, that strange envelope can turn into a much bigger problem.

Sign up for my FREE CyberGuy Report

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
• Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

QR CODE SCAMS RISE AS 73% OF AMERICANS SCAN WITHOUT CHECKING 

A mystery envelope may look harmless, but it can be a sign that your name and address are already being used in a brushing scam. (Kurt “CyberGuy” Knutsson)

What is the empty envelope scam?

The empty envelope scam is often connected to brushing. That is when a third-party seller sends a cheap item, or sometimes an empty envelope, to a real person’s address to make it look like a real order was delivered.

Once the package gets marked as delivered, a shady seller may use that delivery record to post a fake “verified buyer” review on an online marketplace. Those reviews can make junk products look more popular than they really are.

Recent reports describe people receiving small white padded envelopes from unfamiliar or possibly fake sender names. Some people get them more than once. Others receive cheap trinkets, packing material or nothing at all.

That may seem like a strange nuisance. But to me, the bigger concern is this: Someone may already have your name and home address.

Why scammers send empty envelopes

Scammers do not need to send you anything valuable. They only need a tracking number that shows something arrived at a real home. Here is how the scam often works:

A scammer gets your name and address from a data broker, public record, old breach or online leak. Then they create a fake order using your information. Next, they mail a cheap item or an empty envelope to your home.

After the delivery gets marked as complete, the seller can make it appear that you bought the product. A fake positive review may then appear under your name or account details. That helps bad sellers boost ratings and fool real shoppers. It also shows that your personal information may already be floating around, where scammers can grab it.

THE ONE THING SCAMMERS CHECK BEFORE TARGETING YOU ONLINE

Scammers may use real deliveries, empty envelopes or cheap items to create fake “verified buyer” reviews online. (Kurt “CyberGuy” Knutsson)

The QR code twist makes this scam more dangerous

Some mystery packages now include a QR code. The message may sound harmless. It may say something like “scan to see who sent this gift” or “scan to verify delivery.” Do not scan it.

A QR code is a hidden link. You cannot easily see where it leads before your phone reads it. Scammers know curiosity is powerful, especially when a package arrives with your name on it.

That QR code may send you to a fake website that asks for your name, phone number, address, credit card, bank login or shopping account password. It may also try to trick you into entering a one-time verification code.

That is where the real financial risk begins. If you give scammers your login details or banking information, they may be able to take over accounts, make purchases or access payment apps.

What to do if you receive an empty envelope

If an envelope or package arrives, and you did not order it, do not panic. Treat it as a warning sign and take a few smart steps.

1) Do not scan any QR code

Even if the card says you need to scan it to identify the sender, skip it. Go directly to the retailer, shipper or official website yourself.

2) Do not call mystery phone numbers

Scammers may include a fake customer service number or website inside the package. If you need to contact Amazon, Walmart, eBay, USPS, UPS or FedEx, type the official website into your browser or use the company’s official app.

3) Check your shopping accounts

Log in directly to your Amazon, Walmart, eBay, TikTok Shop and other shopping accounts. Look for orders you do not recognize, strange reviews, changed addresses or unfamiliar payment methods.

4) Change important passwords

Start with your email, shopping accounts and financial accounts. Use strong, unique passwords and consider using a password manager to create and store them safely. Do not reuse the same password across multiple sites. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

5) Turn on two-factor authentication

Two-factor authentication, also called 2FA, adds a second step to your login so a password alone isn’t enough. Use an authenticator app when possible. It gives you stronger protection than text messages and makes it harder for a scammer to get into your accounts.

6) Watch your bank and credit card statements

Look for small test charges, unfamiliar purchases, new subscriptions or withdrawals you did not make. Report anything suspicious to your bank right away.

7) Check your credit reports

If you think your identity may be at risk, review your credit reports. You can also consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.

8) Report the package

Report suspicious packages to the U.S. Postal Inspection Service at uspis.gov/report. You can also file a scam report with the FBI’s Internet Crime Complaint Center at ic3.gov. If a retailer’s name appears on the label, report it directly through that retailer’s official site.

WARNING SIGNS YOUR MAIL HAS BEEN FRAUDULENTLY REDIRECTED

If an unexpected envelope includes a QR code, do not scan it. Go directly to the retailer, shipper or official website instead. (Kurt “CyberGuy” Knutsson)

What if you already scanned the QR code?

Scanning a QR code does not always mean your accounts are compromised. But if you entered information, downloaded an app or typed in a verification code, act quickly.

• Close the browser window and stop using the site.
• Do not enter any more personal or financial information.
• Change the password for any account you entered and use a password manager to create and store a strong, unique replacement.
• Turn on two-factor authentication (2FA).
• Check your bank and credit card accounts for suspicious activity.
• Contact your bank if you entered payment information.
• Run a security scan on your phone or computer with a strong antivirus software.
• Delete any app you installed from the QR code.
• Report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov.
• If you entered your Social Security number, banking login or other sensitive information, consider freezing your credit.

Protect your phone from malicious links and QR codes

A good security tool can help block phishing websites, unsafe links and malicious downloads before they cause damage. We recommend using a strong antivirus software because it adds protection beyond basic virus scanning. It includes phishing protection, scam protection and web threat blocking for Windows, Mac, Android and iOS. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

Reduce the personal data scammers can use

Brushing scams often start because your name, home address, phone number or other details are already online. Data brokers collect and sell this information. Scammers can use it to make their tricks feel more believable. A data removal service can help reduce your exposure by requesting that your personal information be removed from broker sites. We recommend using a good data removal service to help remove your personal information from data broker sites and reduce the amount of data scammers can use to target you. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Kurt’s key takeaways

An empty envelope may look harmless, but it can be a sign that your personal information is already being misused. The most important move is to avoid anything inside the package that tries to pull you into another step. Do not scan QR codes from mystery packages. Do not call unknown numbers printed on cards. Do not enter personal information on a website you reached from a package you never ordered. Scammers are counting on curiosity. Slow down, go directly to official websites and secure your accounts before a strange envelope turns into a much bigger headache.

Have you received an empty envelope or mystery package you never ordered? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
• Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com.  All rights reserved.