Full Breakdown
Empty Envelopes and QR-Code Packages: The Rise of a Brushing Scam
6/28/2026, 1:56:55 AM
Core Mechanics of the Empty-Envelope Scam
Scammers obtain a consumer’s name, address, and often phone number from data brokers, public records, or prior data breaches. They then generate a fake online order using that information and mail either a cheap item or an empty white padded envelope to the victim’s mailbox. Once the carrier marks the delivery as complete, the seller can post a fabricated “verified buyer” review under the recipient’s name, inflating product ratings on marketplaces such as Amazon, Walmart, eBay, or TikTok Shop. Some of these mystery packages now include a QR code that, when scanned, redirects the victim to a fraudulent website designed to harvest personal data, banking credentials, or login information.
Background: Brushing and Data Brokerage
The practice of sending unsolicited items to create false purchase records is known as “brushing.” It exploits the fact that a tracking number proves delivery to a real address, allowing dishonest sellers to manipulate marketplace reputations. Data brokers collect and sell personal details, providing the raw material for these schemes. Consumer-protection investigators have repeatedly warned that the presence of an empty envelope signals that a person’s information is already circulating in illicit channels.
Data & Statistics on QR-Code Scams
A recent survey cited in the coverage indicates that 73 % of Americans scan QR codes without verifying the destination, highlighting the vulnerability that scammers exploit. No precise national count of empty-envelope incidents is provided, leaving the overall scale of the brushing operation unclear.
Official Guidance from Law-Enforcement and Consumer Agencies
The U.S. Postal Inspection Service advises reporting suspicious mail at uspis.gov/report. The Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) accepts scam reports at ic3.gov, while the Federal Trade Commission (FTC) encourages victims to file complaints via reportfraud.ftc.gov. Retailers whose names appear on the package label should be contacted through their official websites or apps, not through phone numbers or links included in the mail.
Consumer Alerts & Opposition to Scammers
Consumer-protection groups emphasize that the primary danger lies not in the empty parcel itself but in the data exposure it reveals. By turning a legitimate address into a “verified buyer” record, scammers undermine trust in online reviews and marketplace integrity. These groups recommend reducing one’s digital footprint by employing data-removal services that request deletion of personal records from broker sites.
On-the-Ground Advice: Steps Recipients Should Take
1. Do not scan any QR code.
2. Do not call mystery phone numbers.
3. Verify orders directly on Amazon, Walmart, eBay, TikTok Shop, and other platforms.
4. Change passwords for email, shopping, and financial accounts; avoid password reuse.
5. Turn on two-factor authentication for added security.
6. Monitor bank and credit-card statements for unauthorized charges.
7. Review credit reports from Equifax, Experian, and TransUnion; consider fraud alerts or credit freezes.
8. Report suspicious packages to the U.S. Postal Inspection Service at uspis.gov/report.
Conflicting Reports & Gaps
The article provides a single statistic on QR-code scanning behavior but offers no corroborating data on the frequency of empty-envelope deliveries or the success rate of subsequent phishing attempts. Consequently, the true prevalence of the brushing scam remains uncertain.
Verbatim Quotes
- “com Kurt's key takeaways An empty envelope may look harmless, but it can be a sign that your personal information is already being misused.” — CyberGuy, Tech Advisor
- “Scammers are counting on curiosity.” — CyberGuy, Tech Advisor
What’s Next: Data Removal and Ongoing Vigilance
Experts recommend using reputable data-removal services to limit exposure on broker sites. Ongoing monitoring of credit reports and continued adherence to the outlined security steps are presented as essential defenses against future brushing attempts.
